This vulnerability affects Hanwang e-Face General Management Platform 6.3.5.4. An attacker can remotely exploit a SQL injection flaw by manipulating the 'order' argument in the /sysAuthStr/querySysAuthStr.do endpoint. The vulnerability allows injection of SQL commands due to improper input validation or sanitization. The exploit is publicly available, increasing the risk of exploitation. No official patch or remediation has been confirmed as of the published date.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database with limited confidentiality, integrity, and availability impact as indicated by the CVSS vector. This could lead to unauthorized data access or modification. However, the overall impact is rated medium, reflecting limited scope or complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint where possible and monitor for suspicious activity. Given the exploit is publicly available, prioritize obtaining vendor updates or applying any recommended workarounds once available.