Critical · 9.8 CVE-2022-45564 EUVD-2022-48430GHSA-fpfm-wf57-3589

SQL Injection vulnerability in znfit Home improvement ERP management system V50_20220207,v42 allows attackers to execute arbitrary sql comm…

Published Feb 21, 2023 · Updated Mar 17, 2025 · Assigned by mitre

Description

SQL Injection vulnerability in znfit Home improvement ERP management system V50_20220207,v42 allows attackers to execute arbitrary sql commands via the userCode parameter to the wechat applet.

References

https://github.com/catwj/exp/blob/main/Injected%20by%20Shanghai%20Zhuangmeng%20Information%20Technology%20Co.%2C%20Ltd.md