Executive brief
The Shenzhou Shihan Video Conference System, a platform used for corporate and government communications, contains a critical security flaw in its login page. An attacker can exploit this vulnerability without needing a username or password to gain unauthorized access to the underlying database. This could lead to the theft of sensitive user information, meeting data, or complete control over the system's data.
Technical details
A SQL injection vulnerability exists in the 'user_name' parameter of the JSONPARAM object within the /user/getUserLogin endpoint of Shenzhou Shihan Video Conference System v.1.0. The application fails to sanitize input or use parameterized queries, directly concatenating user-supplied data into a backend MySQL query. This is a pre-authentication vulnerability that can be exploited remotely without user interaction. Attackers can use error-based injection techniques (e.g., using EXTRACTVALUE) to exfiltrate database names, table structures, and sensitive records. While the primary impact is data theft, depending on database permissions and configuration, this could potentially lead to remote code execution.
Affected products
- Shenzhou Shihan Video Conference System 1.0
Timeline
- 2026-07-09: disclosed: Initial vulnerability report on GitHub
- 2026-07-13: advisory: CVE-2026-51821 published by NVD/MITRE