CVE-2026-112252
7.3HighPublished 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Remote, unauthenticated attackers can execute arbitrary SQL and potentially shell commands on the underlying database server via an exposed web service. Public exploit code is already available.
Root cause
The /ws.asmx endpoint fails to sanitize user input passed via the sql parameter directly into the xp_cmdshell procedure, allowing SQL injection.
Affected systems
Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No vendor patch is available; restrict network access to the web service or block external HTTP requests targeting /ws.asmx at the reverse proxy or firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.