This vulnerability affects the jshERP product by jishenghua, specifically in the getUserByWeixinCode function of the UserService.java file. The updatePlatformConfigByKey endpoint improperly validates or sanitizes the weixinUrl parameter, enabling an attacker to perform server-side request forgery (SSRF). This allows the attacker to cause the server to send crafted requests to internal or external systems, potentially bypassing network restrictions. The vulnerability is present in versions 3.0 through 3.6. No official remediation or patch has been released, and the vendor has not responded to the issue report. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the vulnerable server send unauthorized requests to internal or external resources. This may lead to information disclosure or interaction with internal services not directly accessible to the attacker. However, the impact is rated medium due to limited confidentiality, integrity, and availability consequences as per the CVSS 4.0 score. There are no known exploits in the wild at this time.

No official fix or patch is currently available for this vulnerability, and the vendor has not responded to the issue report. Users of jshERP versions 3.0 through 3.6 should consider implementing network-level controls to restrict outbound requests from the affected server to untrusted destinations as a temporary mitigation. Monitor for any updates from the vendor or security advisories for an official patch or remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.