CVE-2026-9544: Sixun Business Management System SQL Injection

CVE-2026-9544 Overview

CVE-2026-9544 is a SQL injection vulnerability in Shenzhen Sixun Software Sixun Shanghui Group Business Management System version 10. The flaw resides in the /api/Dinner/PayConfig endpoint, where the tableno parameter is not properly sanitized before being passed into a SQL query. Attackers can exploit this issue remotely without authentication or user interaction. The exploit code has been published, and the vendor did not respond to disclosure attempts. The weakness is classified under [CWE-74] for improper neutralization of special elements in output used by a downstream component.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL through the tableno parameter, potentially exposing or modifying backend database contents.

Affected Products

Shenzhen Sixun Software Sixun Shanghui Group Business Management System 10
Component: /api/Dinner/PayConfig endpoint
Parameter: tableno

Discovery Timeline

2026-05-26 - CVE-2026-9544 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9544

Vulnerability Analysis

The vulnerability affects the /api/Dinner/PayConfig endpoint of the Sixun Shanghui Group Business Management System. The tableno argument flows into a backend SQL statement without proper sanitization or parameterization. An attacker who manipulates this argument can alter the structure of the executed query. Because the endpoint is reachable over the network and requires no authentication, exploitation is straightforward. Public technical details have been posted to VulDB and a Feishu wiki page, increasing the likelihood of opportunistic attempts against exposed deployments.

Root Cause

The root cause is improper neutralization of user-supplied input ([CWE-74]) before it is concatenated into a SQL query. The tableno parameter is treated as trusted data and is embedded directly into the database call. Without prepared statements or input validation, attacker-controlled SQL syntax becomes part of the executed statement.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted HTTP request to /api/Dinner/PayConfig with a malicious value in the tableno parameter. The injected SQL is executed in the context of the application's database account. Depending on database privileges, the attacker may read sensitive tables, modify records, or enumerate schema structures. The vulnerability description confirms the exploit has been made public.

// Conceptual representation of the vulnerable pattern
// Actual exploit details are described in the referenced VulDB and Feishu advisories
GET /api/Dinner/PayConfig?tableno=<INJECTED_SQL> HTTP/1.1
Host: <target>

Detection Methods for CVE-2026-9544

Indicators of Compromise

HTTP requests to /api/Dinner/PayConfig containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in the tableno parameter.
Unusually long or URL-encoded payloads targeting the tableno argument.
Database errors or anomalous query latency originating from the PayConfig endpoint.

Detection Strategies

Inspect web server and application logs for requests to /api/Dinner/PayConfig with non-numeric or suspicious tableno values.
Deploy Web Application Firewall (WAF) signatures targeting SQL injection patterns on the affected endpoint.
Correlate access logs with database audit logs to identify queries that deviate from normal PayConfig behavior.

Monitoring Recommendations

Enable database query logging and alert on syntax errors or queries containing tautologies like OR 1=1.
Monitor for outbound data transfers from the database server that exceed expected baselines.
Track repeated 4xx or 5xx responses from the PayConfig endpoint, which may indicate exploitation attempts.

How to Mitigate CVE-2026-9544

Immediate Actions Required

Restrict network exposure of the Sixun Shanghui Group Business Management System to trusted internal networks only.
Deploy WAF rules that block SQL metacharacters and known injection payloads on /api/Dinner/PayConfig.
Audit database accounts used by the application and apply least-privilege permissions to limit blast radius.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted but did not respond. Refer to the VulDB Vulnerability #365608 entry and the Feishu Wiki Document for the latest disclosure status.

Workarounds

Place the application behind an authenticated reverse proxy to prevent unauthenticated network access.
Implement input validation at a gateway layer to enforce a strict numeric type for the tableno parameter.
Disable or firewall the /api/Dinner/PayConfig endpoint if it is not required for business operations.

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters on tableno
SecRule REQUEST_URI "@beginsWith /api/Dinner/PayConfig" \
  "chain,deny,status:403,id:1009544,msg:'Possible SQLi on tableno (CVE-2026-9544)'"
  SecRule ARGS:tableno "@rx (?i)(union|select|--|;|'|\")" "t:none"