CVE-2023-54400

CRITICAL 9.8

Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents, with potential for further compromise of the underlying server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

CWE	CWE-89
Vendor	fumasoft
Product	fumeng cloud
Published	Sep 29, 2026

Stay Ahead of the Next One

Get instant alerts for fumasoft fumeng cloud

Be the first to know when new critical vulnerabilities affecting fumasoft fumeng cloud are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Fumasoft / Fumeng Cloud

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/fumasoft-sqli.yaml github.com: https://github.com/emadshanab/goby-poc/blob/main/fumengyun%20%20AjaxMethod.ashx%20SQL%20injection.json vulncheck.com: https://www.vulncheck.com/advisories/fumeng-cloud-sql-injection-via-ajaxmethod-ashx-getempbyname

Credits

🔍 The Shadowserver Foundation