A server‑side request forgery (SSRF) vulnerability exists in the getUserByWeixinCode function of the jshERP application. By manipulating the weixinUrl argument, an attacker can instruct the server to perform HTTP requests to arbitrary URLs, including internal network resources. This can allow the attacker to make HTTP requests to internal resources that are otherwise not publicly reachable.

The vulnerability affects jishenghua jshERP versions up to 3.6, specifically the updatePlatformConfigByKey endpoint that invokes getUserByWeixinCode in the UserService module. No other products or vendors are reported to be affected.

The CVSS score of 5.1 indicates moderate overall severity. The EPSS score is not available, so the precise likelihood of exploitation is uncertain, but the exploit has been publicly disclosed and may be used. The vulnerability is currently not listed in the CISA KEV catalog, suggesting it has not been widely reported in operational environments. The attack is remotely accessible by supplying a crafted weixinUrl value, and it requires no additional authentication or privileged access beyond the normal API usage.