The vulnerability within the AjaxMethod.ashx endpoint permits unauthenticated attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action. This allows attackers to use UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents. The flaw can also facilitate further compromise of the underlying server.

Fumasoft Fumeng Cloud is the affected product. No specific version information is publicly listed in the provided data, so the vulnerability may exist across multiple releases of the cloud service.

The CVSS score of 9.3 indicates high severity. The EPSS score is not available, yet Shadowserver Foundation observed exploitation on 2023‑10‑18, suggesting that the vulnerability is being actively targeted. It is listed as not included in the CISA KEV catalog. Attackers can exploit the flaw without authentication over the network, making it a high‑risk remote attack channel. The potential impact includes data exfiltration, confidentiality and integrity compromise, and possible escalation to full server compromise.