CVE-2026-8320— jshERP 代码问题漏洞

jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery

A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint. Such manipulation of the argument weixinUrl leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

服务端请求伪造(SSRF)

jshERP 代码问题漏洞

jshERP（华夏ERP）是中国季圣华个人开发者的一款国产 ERP 系统。 jshERP 3.6及之前版本存在代码问题漏洞，该漏洞源于updatePlatformConfigByKey Endpoint组件中jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java文件的getUserByWeixinCode函数对参数weixinUrl的操作，可能导致服务端请求伪造。攻击者可远程利用此漏洞。

N/A

N/A