The CVE details an SQL injection flaw in the /api/Dinner/PayConfig endpoint of Shenzhen Sixun Software's Sixun Shanghui Group Business Management System version 10. An attacker can manipulate the tableno parameter to inject arbitrary SQL, potentially gaining unauthorized database access, manipulating records, or reading sensitive data. The flaw falls under CWE‑74 and CWE‑89, indicating unsanitized input leading to executable code injection. Because the vulnerability is exploitable remotely over HTTP, an attacker who can reach the endpoint could compromise the system's confidentiality, integrity, or availability.

Shenzhen Sixun Software's Sixun Shanghui Group Business Management System, specifically version 10, where the /api/Dinner/PayConfig functionality is vulnerable.

The CVSS base score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV, suggesting no confirmed exploitation in the wild yet. Nonetheless, the flaw is publicly known and the vendor has not released a fix; the attack vector appears to be remote over the network, likely through crafted HTTP requests. Because the flaw enables direct SQL injection, successful exploitation could allow an attacker to read or modify database contents, potentially escalating privileges or tampering with business data.