Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Fumeng Cloud lets attackers read or change data

CVE-2023-54400 · published 20 days ago
Summary

The Fumeng Cloud web service lets anyone send a specially crafted request to the getEmpByname function and run their own database commands. This can expose or alter the information stored in the system and may lead to further compromise of the server. Apply the vendor's security update or block the vulnerable endpoint until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
fumasoft fumeng cloud All versions
Original advisory text
Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents, with potential for further compromise of the underlying server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2023-54400 · NVD
CVE-2023-54400 · MITRE
Track software like this
Free during beta