Shenzhou Shihan Multimedia Display CVE-2025-7798
LOWSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability classified as critical has been found in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System up to 8.2. This affects an unknown part of the file /admin/system/structure/getdirectorydata/web/baseinfo/companyManage. The manipulation of the argument Struccture_ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System versions up to 8.2 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the Struccture_ID parameter in the /admin/system/structure/getdirectorydata/web/baseinfo/companyManage endpoint. Despite critical severity designation in the description, CVSS 4.0 scoring reflects low confidentiality and integrity impact (CVSS:4.0 with VC:L/VI:L/VA:L), and EPSS exploitation probability is extremely low at 0.04% (12th percentile), indicating this attack requires valid authentication and specific deployment context. Public exploit disclosure exists (E:P flag), but no active exploitation confirmed in CISA KEV.
Technical ContextAI
The vulnerability stems from insufficient input validation on the Struccture_ID parameter (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected endpoint /admin/system/structure/getdirectorydata/web/baseinfo/companyManage processes user-supplied structure identification values without proper SQL parameterization or escaping, allowing injection of arbitrary SQL syntax. This is a classic SQLi vulnerability in a management interface of an integrated multimedia display system, which typically handles multi-tenant configurations and organizational hierarchies - making structure/directory enumeration and manipulation functionally important but security-sensitive.
Affected ProductsAI
Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System versions up to and including 8.2 are affected. The exact CPE string is not provided in available data, but vendor product identification indicates the multimedia display control system component handles administrative directory and company management functions through version 8.2.
RemediationAI
No vendor-released patch identified at time of analysis. Immediate mitigations for affected installations: (1) Restrict administrative access to the /admin/ endpoint using network-level controls (firewall rules, VPN requirements) limiting access to known administrative IP ranges - this directly reduces PR:L authentication surface by preventing unauthorized credential usage; (2) implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Struccture_ID parameter (e.g., single quotes, UNION keywords, comment sequences); (3) upgrade to a patched version of the Multimedia Integrated Business Display System beyond 8.2 once available from vendor; (4) audit database user privileges for the application service account - ensure the account has minimal required permissions (no DROP, CREATE, or ALTER privileges) to contain potential SQL injection impact even if exploited. Contact Beijing Shenzhou Shihan Technology for patch availability and ETA.
Share
External POC / Exploit Code
Leaving vuln.today