This vulnerability affects version 10 of the Sixun Shanghui Group Business Management System by Shenzhen Sixun Software. It involves an SQL injection flaw in the /api/Dinner/PayConfig endpoint, specifically through the 'tableno' parameter. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation has been published by the vendor, and the exploit is publicly available.

Successful exploitation of this SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The exact impact depends on the database privileges of the affected application. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to affected systems. However, no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, organizations should consider implementing application-layer protections such as web application firewalls (WAFs) to detect and block SQL injection attempts targeting the /api/Dinner/PayConfig endpoint. Additionally, restricting access to this API endpoint where possible and monitoring for suspicious activity related to the 'tableno' parameter is advisable until an official fix is available.