This vulnerability exists in the /base-boot/jmreport/testConnection endpoint of the JimuReport component in erzhongxmu JeeWMS. By manipulating input parameters related to database connection configuration, an attacker can perform injection attacks remotely without authentication. The product uses a rolling release model, so specific version details beyond the affected commit are not provided. The vendor was contacted but did not respond, and no patch or fix information is available. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to perform injection attacks via database connection parameters, potentially leading to unauthorized access or manipulation of backend database connections. The impact is rated medium severity (CVSS 6.9) with partial impact on confidentiality, integrity, and availability. Public exploit code availability increases the risk of attacks, but no known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing network-level protections such as restricting access to the vulnerable endpoint and monitoring for suspicious activity related to the testConnection endpoint. Avoid exposing this endpoint to untrusted networks until a fix is provided.