CVE-2026-105158 in DocSys
Summary
by MITRE • 10/04/2026
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in RainyGao DocSys versions up to 2.02.85 represents a critical security flaw within the application's database management component, specifically located in the BaseController.java file at the function createDBForMysql. This issue stems from improper neutralization of special elements used in an SQL command, commonly known as SQL injection. The root cause lies in how the system handles the url argument passed to this function. Instead of properly sanitizing or parameterizing user-supplied input before incorporating it into database queries, the application directly concatenates or interpolates these values into SQL statements. This lack of validation allows an attacker to inject malicious SQL code that alters the intended logic of the query executed against the MySQL backend.
From a technical perspective, this flaw aligns with CWE-89, which categorizes Improper Neutralization of Special Elements used in an SQL Command. The vulnerability is particularly severe because it can be exploited remotely without requiring any form of authentication or prior access to the system. An attacker located on the network or even over the internet can craft specific HTTP requests targeting this endpoint. By manipulating the url parameter, they can execute arbitrary commands against the database server. This capability enables a range of malicious activities including unauthorized data retrieval, modification of existing records, deletion of critical information, and potentially gaining control over the underlying operating system if the database service runs with elevated privileges or is configured to allow such interactions.
The operational impact of this vulnerability is significant for any organization relying on RainyGao DocSys for document management. Since the exploit code is publicly available, automated scanning tools and malicious actors can easily identify vulnerable instances and launch attacks without needing specialized knowledge. The lack of a response from the project maintainers despite early notification exacerbates the risk profile, leaving users exposed to potential data breaches or system compromise until they take independent action. In terms of adversary tactics, this vulnerability facilitates techniques associated with ATT&CK ID T1059, specifically Command and Scripting Interpreter via SQL commands, allowing attackers to interact directly with backend systems through web application interfaces.
To mitigate the immediate risk, administrators should consider implementing a Web Application Firewall rule that detects and blocks common SQL injection patterns within URL parameters for this specific endpoint. Additionally, reviewing access controls to restrict who can reach the database management interface is advisable if remote administration is not strictly required. The most robust long-term solution involves upgrading to a patched version of RainyGao DocSys once one becomes available or manually patching the source code by implementing prepared statements with parameterized queries for all database interactions involving user input. This ensures that data and code are kept separate, preventing injection attacks regardless of what content is submitted through the url argument.