External risk intelligence

JSH_ERP Fastjson Deserialization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-51743

JSH_ERP is an enterprise resource planning application. Such applications are commonly deployed as web-based interfaces to facilitate business operations, often making them accessible via web browsers. Because the vulnerable endpoint is part of the application's web interface, it is commonly exposed as an internet-facing or internal-facing web application service.

Deserialization

Jishenghua Jsherp

2.3.1 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in an enterprise resource planning system allows unauthenticated attackers to compromise its backend. The exposure of this system, often used for core business operations, raises concerns about potential data breaches and operational disruptions.

Backend vulnerability allows remote system takeover.
Affects critical business operations systems.
Confirm relevance and understand exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the jishenghua JSH_ERP application by sending a specially crafted request to the `/materialCategory/addMaterialCategory` endpoint. This endpoint is vulnerable to deserialization attacks, allowing an attacker to execute arbitrary code on the server if successful.

No authentication or user interaction needed.
Triggered by sending malicious data to an endpoint.
Allows remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected system through a network request targeting the material category endpoint, potentially impacting the integrity and availability of the service.

System integrity and availability at risk.
Network request via vulnerable endpoint.
Arbitrary code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in jishenghua JSH_ERP affects the Fastjson deserialization component, likely managed by application owners or infrastructure teams. The immediate priority is to identify all instances of the affected application, confirm its exposure and business criticality, and then establish ownership for a planned remediation.

Application owners should own the issue.
Verify external reachability and business impact.
Plan remediation considering business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JSH_ERP and why is it used?

JSH_ERP is an enterprise resource planning software developed by jishenghua. Organizations use this platform to manage and streamline critical business operations, such as inventory and supply chain data, through a centralized web-based interface.

What does CWE-502 mean for CVE-2025-51743?

CVE-2025-51743 involves a weakness known as Deserialization of Untrusted Data (CWE-502). This means the application improperly handles incoming data, allowing an attacker to manipulate the software into executing unauthorized commands on the underlying server.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to the /materialCategory/addMaterialCategory endpoint. The vulnerability relies on this endpoint processing malicious data; it does not require authentication or user interaction to succeed.

Is my JSH_ERP instance at risk?

According to Halo Surface Signal, JSH_ERP is typically deployed as a web-accessible service. If your instance is reachable over the internet or accessible via an internal network, it is potentially exposed to this remote attack vector.

What steps should I take if I run JSH_ERP?

First, locate all running instances of JSH_ERP within your environment. Verify whether these systems are reachable by unauthorized users and determine their business criticality. Establish clear ownership for the software so your team can coordinate a planned remediation to secure the application.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.