CVE-2025-0392
MEDIUMGuangzhou Huayi Intelligent Technology Jeewms < 2025-01-01 - SQL Injection via datagridGraph Function
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-0392. PoCs published by iSee857.
AI-analyzed exploit summary The repository contains functional exploit code for CVE-2026-22812, demonstrating remote command execution (RCE) in OpenCode. The script sends a crafted JSON payload to the target's session endpoint, then executes the 'id' command via the shell endpoint, verifying RCE by checking for 'uid=' and 'gid=' in the response.
Description
A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
Exploits (1)
The repository contains functional exploit code for CVE-2026-22812, demonstrating remote command execution (RCE) in OpenCode. The script sends a crafted JSON payload to the target's session endpoint, then executes the 'id' command via the shell endpoint, verifying RCE by checking for 'uid=' and 'gid=' in the response.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L