Cyber Posture

CVE-2025-51745

Critical

Published: 25 November 2025

Published
25 November 2025
Modified
02 December 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 34.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly validates untrusted input to the /role/addcan endpoint, preventing malicious fastjson deserialization payloads from being processed.

SI-2 Flaw Remediation good match
prevent

Enables timely identification, reporting, and patching of the specific fastjson deserialization flaw in JSH_ERP 2.3.1.

CM-6 Configuration Settings partial match
prevent

Ensures secure baseline configuration settings for the fastjson library, such as disabling autoType, to mitigate deserialization risks.

Security SummaryAI

CVE-2025-51745, published on 2025-11-25, is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) discovered in jishenghua JSH_ERP 2.3.1. The flaw affects the /role/addcan endpoint, which is vulnerable to fastjson deserialization attacks, mapped to CWE-502 (Deserialization of Untrusted Data). This Java-based ERP system processes untrusted input insecurely, enabling exploitation through malicious serialized payloads.

The vulnerability can be exploited by any remote attacker with network access to the affected endpoint, requiring no privileges, user interaction, or special conditions due to its low attack complexity. Attackers can achieve high-impact outcomes, including full compromise of confidentiality, integrity, and availability, typically resulting in remote code execution via deserialization gadget chains in fastjson.

Advisories and related resources are available at https://blog.hackpax.top/jsh-erp4/ and https://gist.github.com/Paxsizy/cd1557aeba8093a8650601c4dbffb6f9, with the project hosted on Gitee at https://gitee.com/jishenghua and https://gitee.com/jishenghua/JSH_ERP.

Details

CWE(s)
CWE-502

Affected Products

jishenghua
jsherp
≤ 2.3.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a deserialization flaw (CWE-502) in a public-facing ERP web endpoint, enabling unauthenticated remote code execution, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References