PT-2025-34944 · Unknown · Bian Que Feijiu Intelligent Emergency/Quality Control System

Qianan Security · Published 2025-08-27 · Updated 2026-05-26 · CVE-2025-34162

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Bian Que Feijiu Intelligent Emergency and Quality Control System (affected versions not specified)

Description: An unauthenticated SQL injection vulnerability exists in the GetLyfsByParams endpoint of the /AppService/BQMedical/WebServiceForFirstaidApp.asmx interface. The backend fails to properly sanitize user-supplied input in the strOpid parameter, allowing attackers to inject arbitrary SQL statements. This can lead to data exfiltration, authentication bypass, and potentially remote code execution, depending on backend configuration.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-34162

Affected Products

Bian Que Feijiu Intelligent Emergency/Quality Control System

References · 9

• 🔥 https://cn-sec.com/archives/4160402.html · Exploit
• http://ivtbq.com · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-34162 · Security Note
• https://github.com/wooluo/nuclei-templates-2025hw/blob/main/bianque-medical-sql-injection.yaml · Note
• https://t.me/CVEtracker/31083 · Telegram Post
• https://twitter.com/CVEnew/status/1960822219786891758 · Twitter Post
• https://t.me/cveNotify/164690 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1960898572724944907 · Twitter Post
• https://vulncheck.com/advisories/bian-que-feiju-intelligent-emergency-and-quality-control-system-sqli · Note