Wubang Five In One Safety Production Management Information System
Monthly
SQL injection in the /ws.asmx SOAP endpoint of Wubang Five-in-One Safety Production Management Information System through version 3.5 allows unauthenticated remote attackers to manipulate the 'sql' argument passed to the xp_cmdshell function, with limited confidentiality, integrity, and availability impact and possible escalation to database or OS command execution if MSSQL xp_cmdshell is enabled. Publicly available exploit code exists, but there is no CISA KEV confirmation; the vendor reportedly did not respond to disclosure. The issue is moderate severity (CVSS 5.5) and is most relevant to exposed deployments of this niche industrial safety-management product.
SQL injection in the /ws.asmx SOAP endpoint of Wubang Five-in-One Safety Production Management Information System through version 3.5 allows unauthenticated remote attackers to manipulate the 'sql' argument passed to the xp_cmdshell function, with limited confidentiality, integrity, and availability impact and possible escalation to database or OS command execution if MSSQL xp_cmdshell is enabled. Publicly available exploit code exists, but there is no CISA KEV confirmation; the vendor reportedly did not respond to disclosure. The issue is moderate severity (CVSS 5.5) and is most relevant to exposed deployments of this niche industrial safety-management product.