Description
A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-06-07
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A remote attacker can supply a crafted platformValue parameter to the insertPlatformConfig endpoint, causing the application to send an HTTP request to an arbitrary target server. This server‑side request forgery can expose internal endpoints, access restricted resources, or exfiltrate sensitive data. The flaw is an input validation failure (CWE‑918) that permits an attacker to dictate the destination of outbound requests.

Affected Systems

The vulnerability affects the jishenghua jshERP platform, specifically all installations using version 3.6 and earlier. The affected component is the PlatformConfigService class in the platformConfig Add Endpoint module, which is part of the jshERP application bundle.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate impact, and although the EPSS score is currently unavailable, the exploit has been published and can be performed from a remote host. Because the vendor has not released a fix and the issue remains unpatched, the risk remains. The lack of KEV listing does not diminish the likelihood that this vulnerability could be abused in targeted attacks.

Generated by OpenCVE AI on June 8, 2026 at 02:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a version of jshERP newer than 3.6 that addresses this SSRF if available, or apply any vendor patch as soon as it is released.
  • Restrict the application’s outbound network access so that the insertPlatformConfig endpoint can only contact trusted destinations or is constrained to localhost.
  • Validate or whitelist the platformValue input to prevent the inclusion of arbitrary URLs, ensuring only safe values are accepted.
  • Monitor application logs for unexpected outbound requests and consider deploying a web application firewall that blocks SSRF patterns.

Generated by OpenCVE AI on June 8, 2026 at 02:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 08 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 08 Jun 2026 01:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery
First Time appeared Jishenghua
Jishenghua jsherp
Weaknesses CWE-918
CPEs cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*
Vendors & Products Jishenghua
Jishenghua jsherp
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Jishenghua Jsherp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-08T16:33:10.212Z

Reserved: 2026-06-07T09:27:20.691Z

Link: CVE-2026-11469

cve-icon Vulnrichment

Updated: 2026-06-08T13:52:39.435Z

cve-icon NVD

Status : Deferred

Published: 2026-06-08T00:16:42.580

Modified: 2026-06-08T14:57:14.757

Link: CVE-2026-11469

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-08T03:00:06Z

Weaknesses