EUVD-2026-31817
GHSA-252p-9h4j-wwg2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 10. Affected by this vulnerability is an unknown functionality of the file /api/Dinner/PayConfig. Performing a manipulation of the argument tableno results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in the Sixun Shanghui Group Business Management System 10 exposes the /api/Dinner/PayConfig endpoint to unauthenticated remote attackers who can manipulate the tableno parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network position - only access to the endpoint. A public proof-of-concept exploit is available via a Feishu document, though EPSS remains very low at 0.03% (8th percentile), and no patch has been released as the vendor was unresponsive to coordinated disclosure.
Technical ContextAI
The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the tableno parameter value is concatenated directly into a SQL query without parameterization or adequate sanitization. The affected endpoint /api/Dinner/PayConfig appears to be a REST API component managing dining/payment configuration within a Chinese-market group business management platform. The CPE cpe:2.3:a:shenzhen_sixun_software:sixun_shanghui_group_business_management_system:*:*:*:*:*:*:*:* uses a wildcard version but EUVD-2026-31817 confirms version 10 as the affected release. The CVSS 4.0 E:P modifier (Exploit Maturity: Proof of Concept) aligns with the confirmed public POC, and the Subsequent System impact scores (SC:N/SI:N/SA:N) suggest the injection is constrained to the application's own database context without confirmed lateral movement capability.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted prior to public disclosure and did not respond, leaving no official fix available. Organizations running this system should immediately apply compensating controls: restrict network access to the /api/Dinner/PayConfig endpoint via a web application firewall (WAF) or reverse proxy ACL to trusted internal IP ranges only, as this reduces the AV:N attack surface to a constrained network segment. If WAF rules are available, deploy signatures blocking SQL metacharacters (single quotes, UNION, SELECT, comment sequences) in the tableno parameter. If the application is internet-facing, consider taking the endpoint offline until a patched release is available. If source code access is possible, replacing dynamic SQL string concatenation in the PayConfig handler with parameterized queries or prepared statements would eliminate the root cause (CWE-89). Monitor database query logs for anomalous patterns consistent with UNION-based or error-based SQL injection. Note: endpoint restriction via WAF may affect legitimate dining/payment configuration functionality if the feature is used by external clients.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today