CVE-2025-1535

CVE-2025-1535 is a SQL injection vulnerability affecting Baiyi Cloud Asset Management System version 8.142.100.161. The issue resides in an unknown part of the file /wuser/admin.ticket.close.php, where manipulation of the ticket_id argument triggers the injection. Classified as critical with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), it maps to CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection). The vulnerability was published on 2025-02-21.

The vulnerability enables remote exploitation without authentication or user interaction, allowing unauthenticated attackers with network access to inject malicious SQL payloads via the ticket_id parameter. Successful exploitation can result in limited impacts to confidentiality, integrity, and availability, such as unauthorized data access, modification, or denial of service on the underlying database.

VulDB advisories and a related GitHub repository document the issue, noting that an exploit has been publicly disclosed and may be actively used. The vendor was contacted early regarding disclosure but provided no response, and no patches or mitigations are referenced in available sources. Security practitioners should restrict network access to the affected endpoint, implement web application firewalls to detect SQL injection patterns, and monitor for anomalous database queries until a vendor fix is available.