PT-2026-43249 · Shenzhen Sixun · Sixun Shanghui Group Business Management System

Bigbrother_Man · CVE-2026-9544 · Published 2026-05-26 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Shenzhen Sixun Software Sixun Shanghui Group Business Management System version 10

Description A SQL injection issue exists in the '/api/Dinner/PayConfig' endpoint. This occurs when the tableno argument is manipulated, allowing a remote attacker to execute arbitrary SQL commands. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to view, modify, or delete data from the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-9544

Affected Products

Sixun Shanghui Group Business Management System

References · 6

• 🔥 https://ucn9h68n9289.feishu.cn/wiki/A9WcwRkFsijnyIkf6vlcx13znoh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9544 · Security Note
• https://vuldb.com/submit/815425 · Note
• https://vuldb.com/vuln/365608/cti · Note
• https://t.me/CVEtracker/54977 · Telegram Post
• https://vuldb.com/vuln/365608 · Note