CVE-2025-51744
Published: 25 November 2025
Summary
CVE-2025-51744 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Jishenghua Jsherp. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-51744 is a critical vulnerability in jishenghua JSH_ERP version 2.3.1, affecting the /user/addUser endpoint, which is susceptible to fastjson deserialization attacks. Classified under CWE-502 (Deserialization of Untrusted Data), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its potential for severe impact due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Unauthenticated remote attackers can exploit this vulnerability by sending maliciously crafted requests to the vulnerable endpoint. Exploitation leverages fastjson deserialization to potentially execute arbitrary code, resulting in high impacts on confidentiality, integrity, and availability, such as data theft, system modification, or denial of service.
Advisories and additional details, including potential patches or project updates, are referenced at https://blog.hackpax.top/jsh-erp3/, https://gist.github.com/Paxsizy/cd1557aeba8093a8650601c4dbffb6f9, https://gitee.com/jishenghua, and https://gitee.com/jishenghua/JSH_ERP.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199650
Vulnerability details
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote code execution via exploitation of a public-facing web application endpoint (/user/addUser) through fastjson deserialization, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the fastjson deserialization flaw in JSH_ERP 2.3.1 by identifying, reporting, and applying patches or mitigations for this specific CVE.
Validates untrusted inputs to the /user/addUser endpoint to block malicious fastjson deserialization payloads before processing.
Enforces boundary protection at web interfaces using WAF or similar to inspect and block exploit attempts targeting the vulnerable deserialization endpoint.