CVE-2026-109183: fallo de gravedad media en jishenghua jshERP
jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter
Publicada el · Actualizada el
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.2%
probabilidad de explotación
0.2%top 89% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows, creating audited bills that affect stock and report queries.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
jishenghua · jshERPPoCs públicas encontradas — 1
cve_referencegithub.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_depothead_write_and_derived_read.pyno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — jishenghua jshERP
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-1588MEDIUMjishenghua jshERP installByPath install path traversalEPSS 0.7%CVE-2026-94501HIGHjshERP through 3.6 Privilege Escalation via userBusiness CRUDEPSS 0.5%CVE-2026-94413HIGHjshERP through 3.6 Password Hash Disclosure via /user/infoEPSS 0.5%CVE-2026-94412HIGHjshERP through 3.6 Authorization Bypass via resetPwdEPSS 0.5%CVE-2026-94411HIGHjshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndTypeEPSS 0.5%CVE-2026-1549MEDIUMjishenghua jshERP PluginController uploadPluginConfigFile path traversalEPSS 0.5%
Referencias
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_depothead_write_and_derived_read.pyhttps://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/DepotHeadController.java#L586-L594https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/service/DepotHeadService.java#L1159-L1163https://www.vulncheck.com/advisories/jsherp-through-3.6-approval-bypass-via-adddepotheadanddetail-status-parameter