An unauthenticated SQL injection vulnerability (CWE-89) exists in the GetLyfsByParams endpoint of the Bian Que Feijiu Intelligent Emergency and Quality Control System, specifically in the strOpid parameter. The backend fails to properly neutralize special elements in SQL commands, enabling attackers to inject arbitrary SQL statements. This vulnerability can lead to severe impacts including data exfiltration, bypassing authentication mechanisms, and potentially remote code execution depending on the backend environment. It affects product builds prior to June 2025. The vulnerability was publicly disclosed and evidence of exploitation was observed by Shadowserver Foundation in July 2025. No direct patch links are provided, but remediation is stated to exist in newer product versions.

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL commands on the backend database. This can result in unauthorized data access or exfiltration, bypass of authentication controls, and potentially remote code execution depending on backend setup. The vulnerability is critical with a CVSS 4.0 score of 9.3, reflecting high attack vector accessibility (network, no privileges or user interaction required) and high impact on confidentiality, integrity, and system availability.

The vendor has remediated this vulnerability in versions released after June 2025. Users should upgrade to the latest version of the Bian Que Feijiu Intelligent Emergency and Quality Control System to apply the official fix. Since no patch links are provided, users must consult Feijiu Medical Technology Co., Ltd. for the exact patched versions and update instructions. Until upgraded, affected systems remain vulnerable. Patch status is not yet fully confirmed in detail; check the vendor advisory for the most current remediation guidance.