CVE-2026-37428: SQL Injection in qihang-wms

Successful exploitation of CVE-2026-37428 could grant an attacker unauthorized access to the qihang-wms database. This could lead to the exfiltration of sensitive data, including user credentials, financial information, and other PII. Depending on the database schema and permissions, an attacker might also be able to modify or delete data, potentially disrupting operations or causing further damage. The impact is amplified if the database contains information critical to business operations or regulatory compliance. While no specific real-world exploitation has been publicly reported, SQL injection vulnerabilities are consistently among the most exploited attack vectors.

1. Reserved2026-04-06
2. Published2026-05-13

Due to the lack of a specified fixed_in version, immediate patching isn't possible. The primary mitigation strategy is to implement robust input validation on the datascope parameter within the SysDeptMapper.xml file. This should involve sanitizing or escaping user-supplied input to prevent SQL injection attacks. Consider implementing a Web Application Firewall (WAF) with rules to detect and block SQL injection attempts targeting the datascope parameter. Restrict access to the SysDeptMapper.xml file and the underlying database to only authorized personnel and applications. After implementing these mitigations, review database logs for any suspicious activity related to SQL queries.