An unauthenticated SQL injection vulnerability (CWE-89) exists in the GetLyfsByParams endpoint of the Bian Que Feijiu Intelligent Emergency and Quality Control System. The vulnerability is due to improper neutralization of special elements in the strOpid parameter passed to the /AppService/BQMedical/WebServiceForFirstaidApp.asmx interface. This allows attackers to inject arbitrary SQL statements, potentially leading to data exfiltration, authentication bypass, and remote code execution depending on backend setup. The vulnerability affects builds released prior to June 2025. No explicit patch or fixed version is provided, but newer versions released after June 2025 are stated to remediate the issue. Exploitation was first observed by Shadowserver Foundation on 2025-07-23 UTC. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL commands on the backend database. This can result in unauthorized data disclosure, bypass of authentication mechanisms, and potentially remote code execution depending on backend configuration. The vulnerability is critical with a CVSS 4.0 score of 9.3, indicating a high likelihood of severe impact on confidentiality, integrity, and availability of the affected system.

The vulnerability is remediated in newer versions of the product released after June 2025. Users should upgrade to the latest version of the Bian Que Feijiu Intelligent Emergency and Quality Control System to mitigate this issue. No official patch links or advisories are provided, so users should consult Feijiu Medical Technology Co., Ltd. for updated releases and remediation guidance. Patch status is not yet confirmed with explicit versions; check vendor advisories for current remediation details.