SQL Injection Vulnerability in Leiyuxi Cy-Fast Web Application
CVE-2025-0334
Key Information:
- Vendor
- Leiyuxi
- Status
- Cy-fast
- Vendor
- CVE Published:
- 9 January 2025
Badges
Summary
A vulnerability exists in Leiyuxi Cy-Fast version 1.0, specifically in the listData function located in the /sys/user/listData file. This vulnerability arises due to inadequate validation of input parameters, allowing attackers to manipulate the order of arguments. As a result, it opens the door to SQL injection attacks that can be executed remotely. This security flaw poses a significant risk as it can compromise the application's database integrity and expose sensitive data.
Affected Version(s)
cy-fast 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- π‘
Public PoC available
- πΎ
Exploit known to exist
Vulnerability published
Vulnerability Reserved