CVE-2025-51742
Published: 25 November 2025
Description
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the untrusted 'search' query parameter before passing to Fastjson parseObject(), preventing malicious deserialization payloads from triggering RCE.
Mandates timely remediation of the specific deserialization flaw in the /material/getMaterialEnableSerialNumberList endpoint through patching or code fixes.
Restricts the 'search' parameter to authorized content types and formats, blocking crafted JDBC payloads used in the deserialization attack.
Security SummaryAI
CVE-2025-51742, published on 2025-11-25, is a critical deserialization vulnerability (CVSS 9.8; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting jishenghua JSH_ERP version 2.3.1, mapped to CWE-502 (Deserialization of Untrusted Data). The flaw occurs in the /material/getMaterialEnableSerialNumberList endpoint, where the 'search' query parameter is passed directly to Fastjson's parseObject() method without proper validation, enabling insecure deserialization of untrusted input.
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted 'search' parameter containing a malicious Fastjson payload, such as JDBC-based payloads, to trigger remote code execution (RCE). The attack requires low complexity, no privileges, and no user interaction, allowing full compromise of the affected system with high impacts on confidentiality, integrity, and availability.
Details on exploitation, including a proof-of-concept, are available in references such as https://blog.hackpax.top/jsh-erp/ and https://gist.github.com/Paxsizy/a40334ffa7f05c42bf0348833f830108. The vendor's repositories at https://gitee.com/jishenghua and https://gitee.com/jishenghua/JSH_ERP provide source code and potential patch information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated deserialization flaw in a public-facing web application endpoint, directly enabling remote code execution via crafted HTTP requests, mapping to Exploit Public-Facing Application (T1190).