| शीर्षक | Hunan Zhonghe Baiyi Information Technology Co., Ltd. Baiyi Cloud Asset Management System /wuser/admin.house.collect.php SQL Injection |
|---|
| विवरण | The /wuser/admin.house.collect.php interface in the Baiyi Cloud Asset Management System is vulnerable to SQL injection. Attackers can exploit this vulnerability by crafting malicious request parameters (project_id) to perform Time-Based Blind SQL Injection, bypassing security mechanisms and directly manipulating the database to access sensitive information (such as database names, table data, etc.). This vulnerability affects multiple asset instances and can be triggered without authentication.
Sensitive Data Leakage: Attackers can steal business data, user information, system configurations, etc.
Loss of System Control: Injection attacks may lead to full server compromise.
Business Disruption Risk: Malicious injections can corrupt the database, causing service outages.
Compliance Risks: Data breaches may violate privacy regulations (e.g., GDPR), leading to legal consequences. |
|---|
| स्रोत | ⚠️ https://github.com/stevenchen0x01/CVE/issues/2 |
|---|
| उपयोगकर्ता | Steven_Dra3w (UID 76559) |
|---|
| सबमिशन | 04/02/2025 02:04 PM (2 साल पहले) |
|---|
| संयम | 19/02/2025 07:33 AM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 296237 [Baiyi Cloud Asset Management System तक 20250204 admin.house.collect.php project_id SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|