CVE-2026-112252: SQL Injection in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System

This vulnerability affects the Wubang Five-in-One Safety Production Management Information System up to version 3.5. The issue is a SQL injection in the xp_cmdshell function within the /ws.asmx file, where the sql argument is improperly sanitized. This allows remote attackers to inject SQL commands, potentially compromising the database. The vendor was notified but did not respond or provide a fix. The vulnerability is publicly disclosed with no known exploits in the wild as of now.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to data leakage, modification, or other unauthorized database operations. The CVSS score of 6.9 reflects a medium impact with low attack complexity and no required privileges or user interaction.

No official fix or patch is currently available from the vendor. Since the vendor did not respond to disclosure, users should consider implementing application-level input validation or web application firewalls to detect and block SQL injection attempts targeting the xp_cmdshell function. Monitor for any future vendor advisories or patches and apply them promptly once available.