EUVD-2026-45949
GHSA-8qfv-2g3c-h5jc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SQL injection, PR:N per submitted vector; availability impact excluded absent evidence of destructive query capability.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted is an unknown function of the file /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp?Shine ID=aaa. The manipulation of the argument Structure_ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
SQL injection in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2 allows remote attackers to manipulate backend database queries via the Structure_ID parameter in an admin-facing JSP endpoint. The CVSS 4.0 vector (PR:N/UI:N) indicates no authentication or user interaction is required, though the /admin/ path prefix creates meaningful uncertainty about whether access controls exist that were not reflected in the scoring. A public POC has been released and linked from the VulDB submission, lowering the bar for exploitation. No vendor-issued patch has been identified at time of analysis.
Technical ContextAI
The root cause is CWE-89 (SQL Injection) in a JSP-based web application. The vulnerable endpoint is /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp, where the Structure_ID parameter is concatenated into a SQL query without sanitization or parameterized query binding. The CPE string cpe:2.3:a:beijing_shenzhou_shihan_technology:multimedia_integrated_business_display_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected version range beyond the 8.2.2 instance reported by VulDB. The endpoint path includes the literal string 'Insecure', which may reflect a developer-side test route or legacy naming - this does not mitigate the flaw but suggests the admin interface may have received limited security hardening.
RemediationAI
No vendor-released patch has been identified at time of analysis. As an immediate compensating control, block external access to the /admin/ path prefix at the perimeter firewall or reverse proxy, ensuring the admin interface is not reachable from untrusted networks - this eliminates external attack surface at the cost of requiring VPN or jump-host access for administrators. Deploy a web application firewall (WAF) rule to detect and block SQL injection patterns in the Structure_ID parameter for any deployments where the admin interface must remain network-accessible. Enforce strong authentication on all /admin/ routes at the application or proxy layer if not already in place. Monitor the VulDB entry at https://vuldb.com/vuln/380551 and the Feishu POC document for patch availability updates, and contact Beijing Shenzhou Shihan Technology directly for remediation guidance.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today