Executive brief
qihang-wms is a warehouse management system used to track inventory and logistics operations. A security flaw in the system's database handling allows unauthorized individuals to perform SQL injection attacks. This could lead to the theft of sensitive business data, including customer personally identifiable information (PII) and transaction records.
Technical details
A SQL injection vulnerability exists in qihang-wms (specifically commit 75c15a) within the SysDeptMapper.xml file. The root cause is the improper use of string substitution (${param.dataScope}) instead of prepared statements for the dataScope parameter. An unauthenticated remote attacker can exploit this by sending crafted network requests to manipulate SQL queries. Successful exploitation allows for unauthorized data retrieval, including PII and potentially full database access depending on the database user permissions.
Affected products
- qihangerp qihang-wms V4.0 (commit 75c15a)
Timeline
- 2026-05-13: advisory: NVD publication date