Wubang Five-in-One CVE-2026-112252

Exploitation requires network access to the application's /ws.asmx SOAP/web-service endpoint and the ability to supply the 'sql' parameter to the xp_cmdshell function; per the CVSS vector (AV:N/PR:N/UI:N) no authentication or user interaction is needed against the affected Wubang Five-in-One Safety Production Management Information System (versions up to 3.5). The primary limiting factors are the product's very narrow deployment (a niche Chinese industrial safety-management system, rarely internet-exposed outside its regional user base) and the requirement that the /ws.asmx endpoint be network-reachable to the attacker; escalation to OS command execution additionally depends on the backend MSSQL instance actually having xp_cmdshell enabled.

Signals are mixed and point to a moderate, non-urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but all impact metrics are only Low (VC:L/VI:L/VA:L) and the exploit maturity is E:P (proof-of-concept), yielding a modest 5.5 base score - consistent with VulDB's characteristically conservative scoring. A public exploit exists (POC=YES, referenced GitHub issue), but the vulnerability is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. The most important conflict is semantic: the vulnerable function is named 'xp_cmdshell' - the Microsoft SQL Server stored procedure used for OS command execution - which implies the real-world impact could be full remote code execution (C:H/I:H/A:H), far exceeding the Low impacts assigned in the input vector. This discrepancy should be verified against the product and vendor before deprioritizing based on the 5.5 score alone. Overall: a real, publicly-exploitable unauthenticated SQLi, but against an obscure product with a tiny deployment footprint, so practical risk is targeted rather than broad.

A remote, unauthenticated attacker sends a crafted request to the /ws.asmx web service endpoint, manipulating the 'sql' argument to inject arbitrary SQL into the xp_cmdshell function. A public proof-of-concept exists, lowering the barrier to opportunistic use. If xp_cmdshell execution is reachable on the backing MSSQL instance, the injection could escalate from data access to operating-system command execution on the database host.