fuyang_lipengjun platform CVE-2025-7935

Exploitation requires valid authentication credentials (PR:L in CVSS vector) and network-accessible SysLogController endpoint. The vulnerability is triggered when the key parameter is passed to the SysLogController function and directly concatenated into a SQL query without parameterization. No special configuration is required-the flaw is present in the default codebase. Exploitation is limited to authenticated users; unauthenticated remote exploitation is not possible. Network access must reach the admin controller, typically on internal or VPN-restricted networks, though organizations with public-facing admin panels are at higher risk.

CVSS 4.0 vector indicates authenticated network access (AV:N, PR:L) with low complexity, but impact is heavily scoped: only low confidentiality and integrity impact on the vulnerable component, with no scope or system impact (SC:N, SI:N, SA:N). The resulting CVSS score of 2.1 contradicts the 'critical' classification label in the description, suggesting a tagging error. EPSS score of 0.07% (22nd percentile) aligns with the low CVSS, indicating exploitation is unlikely in widespread automated campaigns. POC availability and public disclosure (E:P in vector) elevate the attack surface slightly among users with direct internet access to admin endpoints. The authentication requirement (PR:L) is a significant limiting factor-unauthenticated remote code execution this is not. Real-world risk is LOW for organizations with proper network segmentation and access controls on admin interfaces; MEDIUM for those exposing admin panels to untrusted users.

An authenticated platform administrator or user with login credentials accesses the SysLogController endpoint and crafts a malicious SQL injection payload in the key parameter-for example, key=1' OR '1'='1. The unsanitized input is concatenated into a SQL query, allowing the attacker to extract sensitive data from the database or modify log records. Publicly available exploit code (disclosed in Gitee issues) automates this attack for users familiar with the platform's API.