JeeWMS JimuReport Database Connection Parameter Injection

A security flaw has been discovered in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This vulnerability affects unknown code of the file /base-boot/jmreport/testConnection of the component JimuReport test-connection Endpoint. Performing a manipulation of the argument dbType/dbDriver/dbUrl/dbUsername/dbPassword results in injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-11457 represents a critical injection vulnerability in erzhongxmu JeeWMS affecting the JimuReport test-connection endpoint. An attacker can manipulate database configuration parameters (dbType, dbDriver, dbUrl, dbUsername, dbPassword) through the /base-boot/jmreport/testConnection file to inject malicious code. With a CVSS score of 7.3 and remote exploitability, this vulnerability poses significant risk to organizations using JeeWMS for reporting functionality. The flaw enables unauthenticated attackers to compromise database integrity, exfiltrate sensitive data, or establish persistence without requiring user interaction. Any organization deploying affected versions should prioritize patching immediately.

Casky's 301 mapped security skills leverage Claude AI's extended reasoning to identify attack patterns associated with TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques. Practitioners using Casky will detect injection attempts through parameter validation failures, unusual database connection strings in application logs, and suspicious command sequences in endpoint requests. The platform's CWE-74 and CWE-707 detection focuses on unsafe variable interpretation and improper input neutralization, flagging when dbDriver or dbUrl parameters contain shell metacharacters, SQL keywords, or JDBC escape sequences. Security teams gain visibility into exploitation patterns—such as attempts to enumerate database types, test connection pooling vulnerabilities, or pivot toward lateral movement—enabling rapid response before attackers establish persistent access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11457.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-11457

Casky has 301 skills that investigate the attack patterns behind CVE-2026-11457. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn