PT-2025-11452 · Shenzhen Mingyuan Cloud Technology · Mingyuan Real Estate Erp System
Afish
·
Published
2025-03-17
·
Updated
2025-03-17
·
CVE-2025-2358
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Shenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP System version 1.0
Description
A critical issue affects the HTTP Header Handler component, specifically the file /Kfxt/Service.asmx. The manipulation of the
X-Forwarded-For argument leads to SQL injection. This issue may be exploited remotely. The exploit has been disclosed publicly, and the vendor was contacted but did not respond.Recommendations
As a temporary workaround, consider restricting access to the
/Kfxt/Service.asmx endpoint until a patch is available. Avoid using the X-Forwarded-For argument in the affected HTTP Header Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Special Elements Injection
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mingyuan Real Estate Erp System