Description
A vulnerability was identified in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A SQL injection flaw exists in Management Platform 6.3.5.4, impacting an unknown function of the /sysAuthStr/querySysAuthStr.do file. By manipulating the argument order, attackers can execute arbitrary SQL statements, which can enable remote access to sensitive data or alteration of database contents. The weakness is classified under CWE‑74 and CWE‑89.

Affected Systems

The affected product is Hanwang e‑Face General Management Platform, version 6.3.5.4. No other versions are listed as vulnerable in the available data.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating moderate severity. The EPSS score of <1% signals a very low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. However, the description confirms that the exploit is publicly available and remotely accessible, which increases its real‑world risk. Potential attackers can reach the vulnerable endpoint over the network and execute the injection without needing local privileges.

Generated by OpenCVE AI on July 26, 2026 at 21:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch for Hanwang e‑Face General Management. non‑vulnerable release if one is available.
  • If a patch is not yet released, block or restrict external traffic to the /sysAuthStr/querySysAuthStr.do endpoint using firewall or access‑control rules, limiting it to trusted IP addresses.
  • Modify the application to reject or sanitize the manipulated argument order, enforcing strict input validation and (mitigating CWE‑89).

Generated by OpenCVE AI on July 26, 2026 at 21:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Title Hanwang e-Face General Management Platform querySysAuthStr.do sql injection
First Time appeared Hanwang
Hanwang e-face General Management Platform
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:hanwang:e-face_general_management_platform:*:*:*:*:*:*:*:*
Vendors & Products Hanwang
Hanwang e-face General Management Platform
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hanwang E-face General Management Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T13:07:09.368Z

Reserved: 2026-07-04T09:02:56.109Z

Link: CVE-2026-14737

cve-icon Vulnrichment

Updated: 2026-07-06T13:07:03.729Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T21:30:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')