CVE-2025-51742
Published: 25 November 2025
Summary
CVE-2025-51742 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Jishenghua Jsherp. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-51742, published on 2025-11-25, is a critical deserialization vulnerability (CVSS 9.8; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting jishenghua JSH_ERP version 2.3.1, mapped to CWE-502 (Deserialization of Untrusted Data). The flaw occurs in the /material/getMaterialEnableSerialNumberList endpoint, where the 'search' query parameter is passed directly to Fastjson's parseObject() method without proper validation, enabling insecure deserialization of untrusted input.
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted 'search' parameter containing a malicious Fastjson payload, such as JDBC-based payloads, to trigger remote code execution (RCE). The attack requires low complexity, no privileges, and no user interaction, allowing full compromise of the affected system with high impacts on confidentiality, integrity, and availability.
Details on exploitation, including a proof-of-concept, are available in references such as https://blog.hackpax.top/jsh-erp/ and https://gist.github.com/Paxsizy/a40334ffa7f05c42bf0348833f830108. The vendor's repositories at https://gitee.com/jishenghua and https://gitee.com/jishenghua/JSH_ERP provide source code and potential patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199642
Vulnerability details
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated deserialization flaw in a public-facing web application endpoint, directly enabling remote code execution via crafted HTTP requests, mapping to Exploit Public-Facing Application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the untrusted 'search' query parameter before passing to Fastjson parseObject(), preventing malicious deserialization payloads from triggering RCE.
Mandates timely remediation of the specific deserialization flaw in the /material/getMaterialEnableSerialNumberList endpoint through patching or code fixes.
Restricts the 'search' parameter to authorized content types and formats, blocking crafted JDBC payloads used in the deserialization attack.