Executive brief
jishenghua jshERP is an open-source Enterprise Resource Planning (ERP) system used by small and medium-sized businesses for inventory and financial management. A security vulnerability allows an administrative user to redirect the application's internal web requests to unintended destinations. This could be used to scan internal corporate networks, access sensitive cloud metadata, or intercept WeChat integration credentials, potentially leading to broader network compromise or data theft.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in jshERP up to version 3.6 within the WeChat integration logic. The root cause is a lack of validation in the `updatePlatformConfigByKey` endpoint in `PlatformConfigController.java`, which allows an authenticated administrator to modify the `weixinUrl` parameter in the database to any arbitrary URL. This malicious URL is subsequently retrieved and used by the `getUserByWeixinCode` function in `UserService.java` to perform an HTTP GET request via `HttpClient.httpGet`. An attacker with administrative privileges can exploit this to perform internal network scanning, access cloud instance metadata (e.g., AWS 169.254.169.254), or exfiltrate WeChat AppID and AppSecret credentials. As of the advisory date, the project has not responded to the issue report.
Affected products
- jishenghua jshERP up to 3.6
Timeline
- 2026-05-11: advisory: CVE-2026-8320 published via VulDB/NVD
- 2026-05-11: disclosed: Public disclosure of the exploit and vulnerability details on GitHub issues