A SQL injection flaw exists in the SysDeptMapper.xml file of the qihang-wms application, specifically triggered by the datascope parameter during commit 75c15a. This flaw allows an attacker to inject arbitrary SQL statements, potentially reading, modifying, or deleting database content and exposing sensitive user information, including personally identifiable data.

The vulnerability is found in the qihang-wms application. No vendor or product name beyond the application itself is provided by the CVE entry. Any instance using the SysDeptMapper.xml configuration and the vulnerable commit is affected.

The CVSS score is 6.5, indicating moderate severity, while the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via a web interface or API that accepts the datascope parameter without proper validation. An attacker who can send crafted requests may extract sensitive database records, compromising confidentiality. Because the flaw resides in the application layer, success requires access to the exposed endpoint, though the exploit script could be automated once the target is identified.