| शीर्षक | Hisense TransTech Hisense Smart Bus Management System 1.0 SQL Injection |
|---|
| विवरण | Hisense Smart Bus Enterprise Management System, developed by Hisense TransTech Co., Ltd., contains a SQL injection vulnerability. The vulnerability is located in the `key` parameter of the `YZSoft/Forms/XForm/BM/BusComManagement/TireMng.aspx` file. The system's backend code (specifically the `Page_Load` method) directly retrieves the user-supplied `key` parameter and assigns it to a `BusEntity` object, passing it to `AdminBLLFactory` for database query operations without effective validation or parameterization. An unauthenticated remote attacker can exploit this vulnerability by sending HTTP requests containing malicious SQL statements to obtain sensitive information from the database. |
|---|
| स्रोत | ⚠️ https://github.com/master-abc/cve/issues/15 |
|---|
| उपयोगकर्ता | jiefengliang (UID 93721) |
|---|
| सबमिशन | 13/01/2026 03:22 PM (9 महीनों पहले) |
|---|
| संयम | 26/01/2026 06:44 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 342881 [Hisense TransTech Smart Bus Management System तक 20260113 TireMng.aspx Page_Load key SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|