PT-2025-51561 · Unknown · Xiongwei Smart Catering Cloud Platform

Yaozhangyiqiyin · Published 2025-12-16 · Updated 2025-12-16 · CVE-2025-14780

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xiongwei Smart Catering Cloud Platform version 2.1.6446.28761

Description A SQL injection issue exists in Xiongwei Smart Catering Cloud Platform version 2.1.6446.28761. The issue is located in an unknown function within the /dishtrade/dish trade detail get file. Manipulating the filter argument can lead to SQL injection. This can be exploited remotely. The exploit is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-14780

Affected Products

Xiongwei Smart Catering Cloud Platform

References · 6

• 🔥 https://github.com/zhangbuneng/3/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14780 · Security Note
• https://vuldb.com/?id.336607 · Note
• https://vuldb.com/?submit.674051 · Note
• https://vuldb.com/?ctiid.336607 · Note
• https://t.me/cveNotify/145923 · Telegram Post