A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. (CVE-2026-112252)

The vulnerability identified as CVE-2026-112252 affects Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to version 3.5. It involves SQL injection via the xp_cmdshell function in the /ws.asmx file, where manipulation of the 'sql' argument enables injection attacks. The vulnerability is remotely exploitable without authentication and can impact confidentiality, integrity, and availability of the system. The vendor has not provided a response or patch, and public exploit information is available, though no active exploitation is confirmed.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access, modification, or deletion, and disruption of system availability. The CVSS score of 7.3 reflects a medium severity impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates. Until a fix is provided, consider restricting access to the vulnerable service and applying network-level controls to limit exposure. Avoid using the affected function if possible.