This vulnerability in erzhongxmu JeeWMS up to commit 141740afb2ba14d441c82a833d0a418d07ca2d69 involves injection via the /base-boot/jmreport/testConnection endpoint of the JimuReport component. By manipulating the input parameters related to database connection configuration (dbType, dbDriver, dbUrl, dbUsername, dbPassword), an attacker can inject malicious input remotely without authentication. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor has not provided any response or patch, and no affected version details are available due to the rolling release nature of the product.

Successful exploitation can lead to injection attacks that may compromise the integrity or confidentiality of the system by executing unauthorized commands or queries. The vulnerability is remotely exploitable without authentication and requires low attack complexity. The impact on confidentiality, integrity, and availability is low to limited according to the CVSS vector. Public exploit code is available, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity related to the testConnection endpoint. Avoid exposing this endpoint to untrusted networks until a patch or official mitigation is provided.