SQL Injection in Fumasoft Fumeng Cloud
CVE-2023-54400
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents, with potential for further compromise of the underlying server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Vulnerability class: SQL Injection
Published .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/oth… (third-party-advisory)
- github.com/emadshanab/goby-poc/blob/main/fumengyun AjaxMethod.ashx SQL injecti… (third-party-advisory)
- www.vulncheck.com/advisories/fumeng-cloud-sql-injection-via-ajaxmethod-ashx-get… (third-party-advisory)
Frequently asked questions
- What is CVE-2023-54400?
- CVE-2023-54400 is a critical-severity vulnerability in Fumasoft Fumeng Cloud, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-09-29.
- How severe is CVE-2023-54400?
- Critical severity. CVSS v3 base score is 9.8 out of 10.