fuyang_lipengjun platform CVE-2025-7934

Exploitation requires valid authenticated user credentials (CVSS PR:L indicates authenticated access is mandatory). The beanName parameter must be processed by the queryPage function without input validation or parameterized query protection. No special non-default configuration is described as required; the vulnerability exists in the standard code flow. Exploitation is limited to authenticated users who have been granted access to the platform, which significantly constrains the attack surface compared to unauthenticated remote code execution vulnerabilities.

This vulnerability presents a critical mismatch between severity classification and real-world risk signals. While classified as critical by the reporter and tagged as SQLi (typically high-impact), the CVSS v4.0 score of 2.1 is exceptionally low due to multiple limiting factors: authentication required (PR:L), limited impact scope (VC:L/VI:L/VA:L with no downstream scope changes), and attack complexity low but not trivial. EPSS score of 0.07% (percentile 22%) indicates this falls in the lowest exploitation probability range despite public POC availability, suggesting either the vulnerability is difficult to exploit in practice, requires a specific non-standard configuration, or the exploitability assessment reflects low likelihood of attackers targeting this particular product. The presence of publicly available exploit code (E:P in vector) elevates risk marginally but does not overcome the fundamental constraint that authentication is required. Security teams should prioritize patch application based on network exposure of authenticated users rather than treating this as an emergency-level incident.

An authenticated platform user with valid credentials submits a POST or GET request to the queryPage endpoint with a malicious SQL injection payload in the beanName parameter, such as beanName=admin' OR '1'='1. The application processes this input without sanitization, allowing the attacker to retrieve sensitive data from the database (e.g., user credentials, configuration data) or modify database contents. Public POC code is available, lowering the technical barrier for attackers with authentication access.