SQL Injection Vulnerability in Shenzhen Sixun Software Business Management System
CVE-2026-9544

6.9MEDIUM

Key Information:

Vendor: Shenzhen Sixun Software
Status: Sixun Shanghui Group Business Management System
Vendor: CVE Published:; 26 May 2026

🔔 Create Shenzhen Sixun Software Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-9544?

A vulnerability has been discovered in the Sixun Shanghui Group Business Management System 10 by Shenzhen Sixun Software. This vulnerability lies within an undocumented function of the /api/Dinner/PayConfig endpoint, where improper input validation allows attackers to manipulate the 'tableno' parameter, leading to a SQL injection exploit. This could enable unauthorized access to the system's database from a remote location. The exploit has been publicly disclosed, and the vendor has yet to respond to reports regarding this issue.

Affected Version(s)

Sixun Shanghui Group Business Management System 10

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-9544 - Proof of Concept