CVE-2025-9391
📋 TL;DR
This CVE describes a SQL injection vulnerability in Bjskzy Zhiyou ERP software up to version 11.0. Attackers can remotely exploit the getFieldValue function in the workflow component to execute arbitrary SQL commands. Organizations using affected versions of this ERP system are at risk.
💻 Affected Systems
- Bjskzy Zhiyou ERP
📦 What is this software?
Zhiyou Erp by Zhiyou Group
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the ERP system.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available according to the references. The vendor has not responded to disclosure attempts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor has not responded
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to version 11.1 or later if available, or implement workarounds.
🔧 Temporary Workarounds
Implement Input Validation
allAdd strict input validation for all SQL-related parameters in the getFieldValue function
Modify source code to validate and sanitize SQL parameters before processing
Use Parameterized Queries
allReplace dynamic SQL construction with parameterized queries or prepared statements
Rewrite affected SQL queries to use parameter binding instead of string concatenation
🧯 If You Can't Patch
- Implement network segmentation to isolate ERP systems from untrusted networks
- Deploy a web application firewall (WAF) with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running Bjskzy Zhiyou ERP version 11.0 or earlier. Review application logs for SQL injection attempts.Check Version:
Check application version through admin interface or configuration filesVerify Fix Applied:
Test the getFieldValue function with malicious SQL input to ensure proper validation and parameterization.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts with SQL-like patterns
- Database error messages containing SQL syntax
Network Indicators:
- Unusual database connection patterns
- SQL injection payloads in HTTP requests to workflow endpoints
SIEM Query:
source="erp_app" AND (message="SQL" OR message="syntax" OR message="injection")