PT-2025-3862 · Guangzhou Huayi Intelligent Technology · Jeewms

Rabbit · Published 2025-01-11 · Updated 2025-01-11 · CVE-2025-0391

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The vulnerable software is Guangzhou Huayi Intelligent Technology Jeewms, specifically versions up to 20241229. The vulnerability is a critical SQL injection issue that affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController.java. This vulnerability can be exploited remotely, and a public exploit has been disclosed, making it possible for attackers to use it. To address this issue, it is recommended to upgrade to version 20250101. The vulnerability has been assigned the CVE identifier CVE-2025-0391. #GuangzhouHuayiIntelligentTechnology #Jeewms #SQLInjection #CVE20250391 #RemoteExploitation #PublicExploit #UpgradeRecommended #CyberSecurity #VulnerabilityDisclosure

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-0391

Affected Products

Jeewms

References · 8

• 🔥 https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKA8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-0391 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0391 · Vendor Advisory
• https://t.me/cvedetector/15056 · Telegram Post
• https://t.me/cvenotify/107147 · Telegram Post
• https://twitter.com/CVEnew/status/1878007297911263653 · Twitter Post
• https://vuldb.com/?id.291125 · Note
• https://vuldb.com/?ctiid.291125 · Note