CVSS 3.1 Score 9.8 of 10 (high)


Published Feb 8, 2024
Updated: Feb 10, 2024


CVE-2024-24003 is a critical vulnerability in jshERP v3.3 that allows for SQL Injection attacks. The vulnerability is present in the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function, which does not properly filter the column and order parameters, enabling an attacker to bypass the protection mechanism in the safeSqlParse method. This vulnerability poses a high risk to organizations as it can be exploited remotely over a network without requiring any privileges or user interaction. It has a CVSSv3 base score of 9.8 out of 10, indicating its severity and potential impact on confidentiality, integrity, and availability of affected systems. Organizations using jshERP v3.3 are advised to apply patches or updates from the vendor to remediate this vulnerability promptly.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-24003 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options