Description
A vulnerability was identified in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An SQL injection flaw exists in Hanwang e-Face General Management Platform version 6.3.5.4, triggered by manipulating the argument order in the /sysAuthStr/querySysAuthStr.do endpoint. This permits an attacker to execute arbitrary SQL commands against the underlying database, potentially exposing confidential data, modifying or deleting records, or further escalating privileges. The vulnerability is categorized as CWE-74 and CWE-89.

Affected Systems

The affected product is Hanwang e-Face General Management Platform version 6.3.5.4. No other versions are listed as vulnerable in the available data.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of <1% signals a very low but non-zero chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The publicly available exploit and remote accessibility suggest that a hostile actor could reach the vulnerable endpoint over the network and inject malicious SQL without requiring local privileges, thereby risking data confidentiality, integrity, and availability.

Generated by OpenCVE AI on August 1, 2026 at 19:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for a vendor‑issued patch or newer release of Hanwang e-Face General Management Platform that addresses the SQL injection flaw and apply it immediately.
  • If no patch exists, limit inbound traffic to the /sysAuthStr/querySysAuthStr.do endpoint to trusted IP addresses or implement firewall or access‑control rules to block untrusted traffic.
  • Apply input validation or sanitization to the argument fields for this endpoint, or deploy a web application firewall rule that blocks malicious request patterns, thereby mitigating the underlying CWE-74 and CWE-89 weaknesses.
  • Regularly monitor application logs and perform vulnerability scans to detect any attempted injection attempts and ensure the mitigation remains effective.

Generated by OpenCVE AI on August 1, 2026 at 19:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Title Hanwang e-Face General Management Platform querySysAuthStr.do sql injection
First Time appeared Hanwang
Hanwang e-face General Management Platform
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:hanwang:e-face_general_management_platform:*:*:*:*:*:*:*:*
Vendors & Products Hanwang
Hanwang e-face General Management Platform
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hanwang E-face General Management Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T13:07:09.368Z

Reserved: 2026-07-04T09:02:56.109Z

Link: CVE-2026-14737

cve-icon Vulnrichment

Updated: 2026-07-06T13:07:03.729Z

cve-icon NVD

Status : Deferred

Published: 2026-07-05T11:16:26.553

Modified: 2026-07-06T18:02:49.450

Link: CVE-2026-14737

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T19:30:10Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')