| शीर्षक | Hanwang Technology Co., Ltd. e-FacePass Integrated Management Platform V6.3.5.4 CWE-89 (Unauthenticated SQL Injection) |
|---|
| विवरण | Hanwang Technology Hanwang e-FacePass Integrated Management Platform contains an unauthenticated SQL injection vulnerability in the /sysAuthStr/querySysAuthStr.do endpoint. The vulnerability exists in a publicly accessible, pre-authentication interface that fails to properly sanitize user-supplied input before incorporating it into backend SQL queries. A remote attacker can exploit this flaw without authentication to execute arbitrary SQL statements, potentially resulting in unauthorized access to sensitive database contents, information disclosure, and further compromise of the affected system. |
|---|
| स्रोत | ⚠️ https://ucn9h68n9289.feishu.cn/docx/RWItdiw5Go02UsxHxgNcMWBqnJc?from=from_copylink |
|---|
| उपयोगकर्ता | bigbrother_man (UID 96003) |
|---|
| सबमिशन | 05/06/2026 04:35 AM (4 महीनों पहले) |
|---|
| संयम | 04/07/2026 11:03 AM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 376320 [Hanwang e-Face General Management Platform 6.3.5.4 querySysAuthStr.do order SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|