EUVD-2026-29948
GHSA-vm77-62fc-6c28
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file. This vulnerability allows attackers to access sensitive database information, including users' Personally Identifiable Information (PII) via a crafted SQL statement.
AnalysisAI
SQL injection in qihang-wms (commit 75c15a) exposes sensitive database contents, including user PII, to unauthenticated remote attackers via the datascope parameter in SysUserMapper.xml. The vulnerability requires no authentication, no user interaction, and is reachable over the network, making automated exploitation feasible. SSVC assessment confirms exploitation has not been observed and EPSS sits at 0.03% (9th percentile), indicating low current exploitation interest despite the permissive attack surface.
Technical ContextAI
qihang-wms is a Chinese e-commerce warehouse management system. The vulnerability resides in SysUserMapper.xml, a MyBatis ORM mapper file - a Java persistence framework that constructs SQL from XML-defined templates. MyBatis is susceptible to SQL injection when dynamic query fragments (e.g., ${} interpolation rather than #{} parameterized binding) are used without sanitization. The datascope parameter appears to be passed directly into a SQL clause without parameterization, satisfying CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected product version is pinned to a specific Git commit (75c15a) rather than a named release, indicating this is an open-source project tracked by commit hash. CPE data returned as n/a means no official NVD product tree entry exists for this software, complicating automated scanner detection.
RemediationAI
No vendor-released patched version has been identified at time of analysis; the fix version is not independently confirmed from available data. Organizations running qihang-wms at or before commit 75c15a should review the SysUserMapper.xml file and convert any ${} dynamic SQL interpolation on the datascope parameter to MyBatis parameterized #{} bindings, which enforce prepared statement semantics and eliminate injection. As a compensating control, restrict network access to the WMS application to trusted internal networks only, preventing unauthenticated internet-facing exploitation - this directly counters the AV:N/PR:N attack vector but does not fix the underlying flaw. Additionally, apply database least-privilege principles: ensure the WMS database account cannot read user PII tables beyond application requirements. The researcher disclosure is documented at https://github.com/Y4y17/CVE/blob/main/%E5%90%AF%E8%88%AA%E7%94%B5%E5%95%86WMS/SQL%20Injection%20Vulnerability%20-%202.md and https://gist.github.com/Y4y17/6587147a37eba5b31de832e067f317ef, which may contain additional technical detail useful for patch verification.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today