CVE-2026-51821 Details
Description
SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint
A SQL injection vulnerability has been identified in the Shenzhou Shihan Video Conference System version 1.0. This vulnerability allows remote attackers to execute arbitrary code by exploiting the '/user/getUserLogin' endpoint. The issue arises because the 'user_name' parameter is directly concatenated into the MySQL query without proper security measures, such as parameterization or input validation. This vulnerability can be triggered without authentication, making it easily exploitable.
Users are advised to use parameterized queries or prepared statements to prevent SQL injection vulnerabilities. Strict input validation and allow-listing for the 'user_name' parameter should also be implemented. Additionally, deploying a Web Application Firewall (WAF) can help filter out malicious SQL patterns temporarily.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sign9981/CVE/issues/2 | CISA-ADP | ExploitIssue TrackingRemedy |
| https://github.com/sign9981/CVE/issues/2 | [email protected] | ExploitIssue TrackingRemedy |
| https://www.cnblogs.com/goww/p/19942271 | [email protected] | Content WallPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Shenzhou Shihan Video Conference System | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |