A SQL injection flaw exists in the Staffshinel Ds.jsp endpoint of the Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System. The vulnerability is triggered by malformed input to the Structure_ID parameter, which is concatenated directly into a database query. Attackers can inject arbitrary SQL statements, enabling them to read, modify, or delete sensitive data stored in the system’s database. The weakness is catalogued as CWE-89 and CWE-74, reflecting improper input handling in a URL path context. Because the point of injection lies in a publicly accessible administrative interface, any user who can reach the endpoint could potentially exploit the flaw, subject to the environment’s authentication and authorization controls.

The affected product is the Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System, version 8.2.2. The vulnerable code resides in the /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp file, which is reachable via HTTP requests to the /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp endpoint. Only installations running this unpatched version are at risk.

The CVSS score of 6.9 indicates a moderate severity vulnerability. The description states that attacks can be launched remotely, but it does not specify whether authentication is required, so the assumption is that the publicly reachable endpoint can be exploited even by unauthenticated users. With an EPSS score below 1%, the overall probability of exploitation is low, yet the public availability of a working exploit raises the practical risk. Until a vendor patch or a mitigating control is applied, the flaw remains a significant concern for confidentiality and integrity of the system’s data.