An attacker can send crafted requests to the ws.asmx service and target the xp_cmdshell function to inject arbitrary SQL through the sql argument. The injection enables the attacker to read, modify, or delete database records, potentially affecting all data stored in the system. This flaw bypasses authentication and is not limited to local usage, giving an adversary full write access to the application database.

The issue occurs in Wuxi Wubang Security Software’s Wubang Five‑in‑One Safety Production Management Information System, specifically versions up to 3.5. Admins should verify the exact build and apply any available updates.

The CVSS score of 6.9 indicates a moderate severity with a potential for significant data compromise. EPSS is not reported; the vulnerability is not listed in KEV, though it has public exploits. Because the attack can be launched remotely against the ws.asmx endpoint, the likelihood of exploitation is non‑negligible for exposed systems. A successful exploit would grant full data integrity and confidentiality loss.