CVE-2025-2112 is a medium severity SQL injection flaw (CVSS 6.3) in user-xiangpeng yaoqishan. The typeId parameter handled by cn/javaex/yaoqishan/service/media_info/MediaInfoService.java is passed into a database query without safe handling. No fixed version is confirmed, so restrict access and review the code.
What's affected
- Product: user-xiangpeng yaoqishan
- Affected versions: up to commit a47fec4a31cbd13698c592dfdc938c8824dd25e4 (rolling releases, so no version numbers)
- Vulnerable file and parameter:
cn/javaex/yaoqishan/service/media_info/MediaInfoService.java, argumenttypeId - CVSS: 6.3 (Medium), vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Published: 2025-03-08
Neither the record nor the pages I read name a fixed release. Check the project directly for an updated build, and treat the product as unpatched until you can confirm one.
The record says the attack can be launched remotely and that the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false for this CVE. The record also says the vendor was contacted early and did not respond.
How to check if you're exposed
This is a standalone Java application, so there is usually no package manager entry to query. Start by confirming whether you run it and which version.
# find copies of the vulnerable file on your hosts
find / -name "MediaInfoService.java" -not -path "*/proc/*" 2>/dev/null
# see how the parameter is used in the code
grep -rn "typeId" . --include=*.java | head
If the file exists and the query is built by joining strings, treat the host as exposed. Then look at your web server or application logs for requests to this path that carry unusual quote characters or SQL keywords in typeId. Odd requests do not prove compromise, but a clean log is useful evidence too.
If the application sits behind a login page, check who can reach it. Work out whether it is reachable from the internet or only from an internal network. You can also run a free in-browser dependency scan against any dependency manifest in the project, although it will not detect the code level weakness in this case.
What to do now
- Find every instance of yaoqishan in your estate, including test and demo copies that nobody remembers.
- Check the project for an updated release. If none is named, plan to patch the code yourself or retire the application.
- Change the database query behind
cn/javaex/yaoqishan/service/media_info/MediaInfoService.javato use prepared statements with bound parameters instead of string concatenation. - Limit the database account the application uses. It should not own the schema or hold rights it does not need.
- Put the admin area and any login page behind a network allowlist, VPN or an extra authentication layer until the code is fixed.
- Review database contents and web logs for the period the application was reachable, and rotate any credentials stored in the database.
Why it matters
The weakness is CWE-89, SQL injection, filed with its parent class CWE-74. User input reaches a database query and changes what the query means. The usual result is that someone who should only be able to read one record can read, change or remove others.
The CVSS vector shows network access, low complexity and no privileges or user interaction. Confidentiality, integrity and availability impacts are each rated low, which is why the score is 6.3 rather than higher. The affected function is getMediaLisByFilter, which builds a query from a type filter. The record says the project ships rolling releases, so there are no version numbers to compare against and you have to look at your commit history. Small projects like this often get copied into production unchanged, and a public exploit disclosure means attackers do not need to work out the details themselves.
Quick check
Is CVE-2025-2112 exploited in the wild?
The CISA Known Exploited Vulnerabilities flag is false and none of the pages I read report active exploitation. The record does say a public exploit disclosure exists, so treat it as easy to attempt.
Does a web application firewall fix this?
It can reduce risk while you work, but it does not remove the flaw. The lasting fix is a parameterized query in the code.
Sources
Last reviewed: 19 October 2026.
