RULE(RULE ID:338942)

Rule General Information
Release Date: 2025-05-20
Rule Name: SHIKONGZHIYOU ERP indexService.notice SQL Injection Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: SHIKONGZHIYOU ERP is an integrated enterprise resource planning system focused on delivering comprehensive business process management to enhance operational efficiency and decision support for businesses. There is an SQL injection vulnerability exists in its indexService.notice endpoint. An unauthenticated attacker could execute arbitrary SQL statements through the vulnerability, which may result in the disclosure of sensitive information and even gain system privileges on the server.
Impact: An attacker can inject arbitrary sql commands to view or change the database of the target by exploiting the vulnerability successfully.
Affected OS: Windows, Linux, Others
Reference:
Solutions
Please contact the software vendor to update the software patch.