CVE-2025-5493 is a medium severity SQL injection in Baison Channel Middleware Product 2.0.1. The data argument of the /e3api/api/main/ToJsonByControlName endpoint reaches a database query unsafely, and the record says it can be attacked remotely. No fixed version is named, so reduce exposure and ask the vendor.
What's affected
- Product: Baison Channel Middleware Product.
- Affected: version 2.0.1, per the record.
- Endpoint:
/e3api/api/main/ToJsonByControlName, argumentdata. - Fixed version: none is named in the record or in the reference material listed there. Do not assume a patch exists.
- Authentication: the CVSS vector shows low privileges required, so an account on the system is needed.
The record notes that exploit details have been disclosed publicly. That does not mean attacks have been seen. It means the technical write-up is available to anyone, which shortens the time between disclosure and misuse. The CVE is not on the CISA KEV list.
How to check if you're exposed
This is a commercial middleware product, so check it where it runs.
- Look at the version shown in the product's administration screens or installer records. Version 2.0.1 is the one named.
- Search your reverse proxy and application logs for requests to the endpoint path above, and compare the callers with the systems you expect.
- Ask your integration team which internal and external systems can reach the API, and whether it sits on the public internet.
A library scan will not find this product, so keep it in your asset inventory instead, with the owner and the vendor contact recorded.
What to do now
- Confirm whether you run version 2.0.1 and who can reach the API.
- Contact the vendor and ask for a fixed build or a written mitigation, and record the answer.
- Restrict network access to the API to the systems that need it, and remove any direct internet exposure.
- Review accounts that can call the API and remove any that are unused, since the flaw needs a logged in user.
- Watch logs for unusual requests to the named endpoint, and plan a replacement or upgrade path if the vendor cannot provide a fix.
Why it matters
The record lists injection and SQL injection as the weakness class. A value supplied in the data argument ends up inside a database statement, so the caller can change the meaning of the query. Parameterized queries remove this class of bug by keeping data and code apart.
Middleware is a sensitive place for this flaw. It usually sits between order, stock and finance systems, which means the database behind it often holds commercial records. A medium score reflects the need for an account, but accounts in integration products are often shared or long lived, so do not let the label lower your attention.
The weakness is classed as CWE-74 (Injection) and CWE-89 (SQL Injection). Severity in the CVE record: medium, CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Quick check
Is a patch available?
None is named in the CVE record. Ask the vendor directly and restrict network access in the meantime.
Why is it only medium severity?
The vector requires low privileges, meaning a valid account, and the impact scores are low across confidentiality, integrity and availability. Shared accounts can still make it matter.
Sources
- Safeguard Gold entry for CVE-2025-5493
- Researcher write-up on Medium (listed in the CVE record, not fetched)
- VulDB entry 310910 (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
