Horizon Alert
Summary of the vulnerability and why it matters
An unauthenticated SQL injection vulnerability exists in a web service for the Bian Que Feijiu Intelligent Emergency and Quality Control System. This flaw allows attackers to inject malicious SQL commands by manipulating specific input, which could potentially lead to unauthorized access to sensitive data or system compromise. Teams should pay attention because this vulnerability impacts a critical system used for emergency and quality control.
- Affects systems reachable from the internet.
- Enables data theft or system control.
- Impacts emergency response capabilities.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can target the Bian Que Feijiu Intelligent Emergency and Quality Control System by sending crafted input to the `GetLyfsByParams` endpoint. This allows them to inject malicious SQL commands to steal sensitive data or potentially bypass authentication.
- Target: `/AppService/BQMedical/WebServiceForFirstaidApp.asmx`
- Vulnerable parameter: `strOpid`
- No authentication required
Live Threat
Current exploitation, exposure, and threat context
The vulnerability allows unauthenticated SQL injection via a web service interface, potentially leading to data exfiltration, authentication bypass, and remote code execution. While the system is designed for emergency and quality control, its internal nature and typical network isolation suggest direct external exploitation might be less common than for widely internet-facing applications. Evidence of exploitation was observed in July 2025.
- Exploitation evidence observed.
- Potential for significant impact.
- Internal system context.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate detection and containment of the SQL injection vulnerability in the Bian Que Feijiu Intelligent Emergency and Quality Control System. Given the critical severity and observed exploitation, focus on identifying and isolating affected systems to prevent data exfiltration and further compromise. Actively monitor network traffic for indicators of compromise related to this specific vulnerability.
- Block SQLi exploit attempts.
- Isolate vulnerable services.
- Monitor for unauthorized data access.
