CVE-2026-108778: SQL Injection in erzhongxmu JEEWMS

This vulnerability exists in erzhongxmu JEEWMS up to version 2026.09.27-W39 in the WmInQmIController.list function within src/main/java/com/zzjee/wm/controller/WmInQmIController.java. The issue is caused by improper sanitization or validation of the searchstr argument, enabling remote attackers to inject SQL commands. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor was notified but did not respond, and no official patch or remediation is currently available.

Successful exploitation of this SQL injection vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification within the affected component. The impact is limited by the low complexity and privileges required but is mitigated somewhat by the low confidentiality, integrity, and availability impact metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing application-layer mitigations such as input validation and parameterized queries if possible. Monitor for updates from the vendor regarding an official fix.