CVE-2025-51744
Published: 25 November 2025
Description
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the fastjson deserialization flaw in JSH_ERP 2.3.1 by identifying, reporting, and applying patches or mitigations for this specific CVE.
Validates untrusted inputs to the /user/addUser endpoint to block malicious fastjson deserialization payloads before processing.
Enforces boundary protection at web interfaces using WAF or similar to inspect and block exploit attempts targeting the vulnerable deserialization endpoint.
Security SummaryAI
CVE-2025-51744 is a critical vulnerability in jishenghua JSH_ERP version 2.3.1, affecting the /user/addUser endpoint, which is susceptible to fastjson deserialization attacks. Classified under CWE-502 (Deserialization of Untrusted Data), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its potential for severe impact due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Unauthenticated remote attackers can exploit this vulnerability by sending maliciously crafted requests to the vulnerable endpoint. Exploitation leverages fastjson deserialization to potentially execute arbitrary code, resulting in high impacts on confidentiality, integrity, and availability, such as data theft, system modification, or denial of service.
Advisories and additional details, including potential patches or project updates, are referenced at https://blog.hackpax.top/jsh-erp3/, https://gist.github.com/Paxsizy/cd1557aeba8093a8650601c4dbffb6f9, https://gitee.com/jishenghua, and https://gitee.com/jishenghua/JSH_ERP.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote code execution via exploitation of a public-facing web application endpoint (/user/addUser) through fastjson deserialization, directly mapping to T1190: Exploit Public-Facing Application.