Executive brief
jshERP is an open-source ERP system for small and medium enterprises. The /user/info endpoint fails to redact unsalted MD5 password hashes, allowing any authenticated user to retrieve password digests for other users in the same tenant. Attackers can perform offline hash cracking or potentially achieve account takeover through direct hash reuse.
Technical details
The vulnerability exists in the /user/info endpoint which returns the password field for queried users without redaction. An authenticated attacker with a low-privilege account can enumerate tenant users via /user/list and then query /user/info with arbitrary user IDs to obtain unsalted MD5 hashes. The lack of salting and weak hashing algorithm make these hashes susceptible to offline cracking or rainbow table attacks.
Affected products
- jishenghua jshERP through 3.6
Timeline
- 2026-09-21: disclosed