PT-2025-51184 · Shenzhen Sixun · Sixun Shanghui Group Business Management System

Yaozhangyiqiyin · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-14696

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shenzhen Sixun Software Sixun Shanghui Group Business Management System version 4.10.24.3

Description A weakness exists in Shenzhen Sixun Software Sixun Shanghui Group Business Management System that allows for weak password recovery. This issue is related to an unknown functionality within the file /api/GylOperator/UpdatePasswordBatch. The attack can be initiated remotely, and an exploit is publicly available. The vendor was notified but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-14696

Affected Products

Sixun Shanghui Group Business Management System

References · 9

• 🔥 https://github.com/zhangbuneng/Sissyun-Shanghui-7-Unauthorized-password-modificationfication-vulnerability./issues/1#issue-3688839620 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14696 · Security Note
• https://vuldb.com/?id.336414 · Note
• https://vuldb.com/?submit.705601 · Note
• https://vuldb.com/?ctiid.336414 · Note
• https://t.me/CVEtracker/39792 · Telegram Post
• https://twitter.com/CVEnew/status/2000611239010173311 · Twitter Post
• https://t.me/cveNotify/145734 · Telegram Post
• https://github.com/zhangbuneng/Sissyun-Shanghui-7-Unauthorized-password-modificationfication-vulnerability./issues/1 · Note