Critical · published November 25, 2025
🔥 A Fastjson deserialization flaw in JSH_ERP 2.3.1 could let an attacker remotely execute code just by manipulating a single search query! Think of it as a recipe book that blindly follows any ingredient list you give it — without checking if the items are safe. This flaw allows malicious payloads to sneak in like expired items, contaminating the entire kitchen! An attacker could potentially take complete control of the server, executing any commands they desire. This means they can access sensitive data, modify configurations, or even wipe everything clean — it’s a recipe for disaster!
Think of it as a recipe book that blindly follows any ingredient list you give it — without checking if the items are safe. This flaw allows malicious payloads to sneak in like expired items, contaminating the entire kitchen! The vulnerability arises from the /material/getMaterialEnableSerialNumberList endpoint directly passing user input to parseObject(), allowing for arbitrary code execution via crafted JDBC payloads.
An attacker could potentially take complete control of the server, executing any commands they desire. This means they can access sensitive data, modify configurations, or even wipe everything clean — it’s a recipe for disaster! Update JSH_ERP to version 2.3.2 or later to fix this vulnerability. Additionally, implement input validation to ensure only safe data is processed and consider disabling deserialization of untrusted data. Don't wait — act fast! You’ve got this! With a quick update and some preventive measures, you can secure your system and keep those malicious chefs out of your kitchen! 🛡️