PT-2025-30364 · Jsherp · Jsherp

Zast.Ai · Published 2025-07-22 · Updated 2025-08-11 · CVE-2025-7947

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.6

Description A critical issue exists in jshERP. The vulnerability affects an unknown function within the /user/delete file of the Account Handler component. Manipulation of the ID argument results in improper authorization. Remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.

Recommendations jshERP versions prior to 3.6: Update to version 3.6 or later to address the improper authorization issue. As a temporary workaround, restrict access to the /user/delete file to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

IDOR

Weakness Enumeration

CWE-285

CWE-266

CWE-639

Related Identifiers

CVE-2025-7947

Affected Products

Jsherp

References · 13

• 🔥 https://github.com/jishenghua/jshERP/issues/124 · Exploit
• https://osv.dev/vulnerability/CVE-2025-7947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7947 · Security Note
• https://vuldb.com/?ctiid.317088 · Note
• https://vuldb.com/?id.317088 · Note
• https://twitter.com/dailycve/status/1950589390742507918 · Twitter Post
• https://t.me/cveNotify/131654 · Telegram Post
• https://vuldb.com/?submit.619276 · Note
• https://twitter.com/CVEnew/status/1947494220412887173 · Twitter Post
• https://t.me/cvenotify/129761 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947586643961037242 · Twitter Post
• https://t.me/cveNotify/130285 · Telegram Post
• https://t.me/CVEtracker/29672 · Telegram Post