PT-2025-31470 · Kehua · Kehua Charging Pile Cloud Platform

Qiantx · Published 2025-07-31 · Updated 2025-09-12 · CVE-2025-8347

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kehua Charging Pile Cloud Platform version 1.0

Description A critical vulnerability exists in Kehua Charging Pile Cloud Platform 1.0. The issue involves a SQL injection affecting an unknown part of the /sys/task/findAllTask file. This allows for remote exploitation. The exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-8347

Affected Products

Kehua Charging Pile Cloud Platform

References · 9

• 🔥 https://github.com/qiantx/cve/blob/main/CVE2.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-8347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8347 · Security Note
• https://vuldb.com/?submit.617567 · Note
• https://t.me/cveNotify/135310 · Telegram Post
• https://vuldb.com/?id.318297 · Note
• https://twitter.com/CVEnew/status/1950771816747630900 · Twitter Post
• https://vuldb.com/?ctiid.318297 · Note
• https://t.me/CVEtracker/28819 · Telegram Post