CVE-2023-54400

Name of the Vulnerable Software and Affected Versions Fumasoft Fumeng Cloud (affected versions not specified)

Description An issue exists in the 'AjaxMethod.ashx' endpoint that allows unauthenticated remote attackers to perform SQL injection. By manipulating the Name parameter within the getEmpByname() action, attackers can use UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents, which may lead to a full compromise of the underlying server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the Name parameter in the 'AjaxMethod.ashx' endpoint until the issue is resolved.