PT-2025-3863 · Guangzhou Huayi Intelligent Technology · Jeewms

Rabbit · Published 2025-01-11 · Updated 2025-01-11 · CVE-2025-0392

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Guangzhou Huayi Intelligent Technology Jeewms versions up to 20241229

Description A critical SQL injection vulnerability was found in the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store code leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Guangzhou Huayi Intelligent Technology Jeewms versions up to 20241229, upgrade to version 20250101 to address this issue. As a temporary workaround, consider restricting access to the /graphReportController.do file or disabling the datagridGraph function until the upgrade is applied. Avoid using the store code argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-0392

Affected Products

Jeewms

References · 8

• 🔥 https://gitee.com/erzhongxmu/JEEWMS/issues/IBFK93 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-0392 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0392 · Vendor Advisory
• https://vuldb.com/?id.291126 · Note
• https://twitter.com/CVEnew/status/1878040159133769892 · Twitter Post
• https://t.me/cvenotify/107148 · Telegram Post
• https://t.me/cvedetector/15057 · Telegram Post
• https://vuldb.com/?ctiid.291126 · Note