CVE-2023-54400

Fumasoft Fumeng Cloud is vulnerable to a SQL injection in the AjaxMethod.ashx endpoint. Unauthenticated remote attackers can inject arbitrary SQL via the Name parameter of the getEmpByname action. By using UNION-based SQL injection techniques against the Microsoft SQL Server backend, attackers ca...