CVE Intelligence
Analysis AI-assisted

CVE-2026-1546: Jishenghua jshERP SQL Injection via Excel Item Import

A public CVE record reports an SQL injection flaw (CWE-89) in Jishenghua jshERP up to 3.6, reached through the barCodes argument of an Excel item import function. The record states the exploit is publicly disclosed and the issue can be triggered remotely, and NVD scores it 9.8 (critical). No fixed version is listed, and the project had not responded at the time of the record.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The public record describes an SQL injection weakness (CWE-89) in jshERP up to version 3.6. The affected function, getBillItemByParam, is reached through the item import Excel endpoint and processes the barCodes argument. The record states the issue can be initiated remotely.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which if accurate implies high confidentiality, integrity and availability impact.
  • The CNA VulDB lists other scores: 6.3 under 3.1, 6.5 under 2.0 and 2.1 under 4.0.
  • Successful SQL injection could expose or alter database content, depending on database account privileges and deployment.

Affected products and versions

  • Jishenghua jshERP, versions up to and including 3.6, according to the record.
  • The record lists no fixed versions. This does not prove that no fix exists.

Exploitation status

  • The record states the exploit has been publicly disclosed and may be used.
  • CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Check the upstream project for updates: jshERP on GitHub.
  • The project was notified through an issue report and had not responded when the record was made. Treat the installation as unpatched until a fix is confirmed.
  • Restrict access to the import functionality to trusted users and networks.
  • If you maintain a fork or custom code, use parameterized queries and strict input validation for all parameters that reach the database.
  • Limit the database account used by the application to the privileges it actually needs.

Detection guidance

  • Review web and application logs for unusual requests to the item import endpoint, particularly abnormal or oversized values in the barCodes parameter.
  • Monitor database logs for unexpected query errors or query patterns originating from the application account.

Limitations of the available information

  • No fixed version is listed.
  • One VulDB reference carries the tag Permissions Required, while the CVSS vector indicates no privileges required. Whether authentication is needed is unclear from the record.
  • No EPSS or SSVC data is available.
  • Technical exploit details are intentionally omitted here.

Frequently asked questions

Is this jshERP vulnerability being actively exploited?

CISA KEV does not list this CVE, and the sources consulted do not confirm exploitation in the wild. The record does state that a public exploit has been disclosed and may be used, so exposed systems should be treated as at risk.

Is there a fixed version of jshERP for this issue?

The record lists no fixed version, and the project had not responded to the issue report when the record was made. Check the upstream repository for updates and treat the installation as unpatched until a fix is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.