CVE-2026-9551 in Parking Management System 停车场管理系统
Summary
by MITRE • 05/26/2026
A vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0. This affects the function xp_cmdshell of the file ParkingRecord/ExportParkingRecords of the component API Endpoint. The manipulation of the argument Value leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/26/2026
The Das Parking Management System version 6.2.0 contains a critical sql injection vulnerability within its API endpoint functionality that poses significant security risks to organizations utilizing this parking management solution. This vulnerability specifically resides in the xp_cmdshell function implementation within the ParkingRecord/ExportParkingRecords component, representing a severe oversight in the system's security architecture that directly violates established security principles and best practices for web application development.
The technical flaw manifests through improper input validation and sanitization within the xp_cmdshell function, which accepts user-controllable parameters through the Value argument without adequate protection mechanisms. This vulnerability falls under the CWE-89 category of sql injection, where malicious input can be executed within the database context, allowing attackers to manipulate database queries and potentially execute arbitrary commands on the underlying database server. The exploitation occurs through the API endpoint, which provides remote access capabilities, eliminating the need for physical system access and significantly expanding the attack surface.
The operational impact of this vulnerability extends beyond simple data theft, as the ability to execute commands through xp_cmdshell could enable attackers to escalate privileges, access sensitive system files, modify database contents, or even establish persistent backdoors within the network infrastructure. The public availability of exploitation tools further compounds the risk, as it removes the barrier to entry for potential attackers who may not possess advanced technical skills. This vulnerability directly aligns with ATT&CK technique T1078.004 for valid accounts and T1566.001 for spearphishing, as attackers can leverage this vulnerability to gain unauthorized access and potentially move laterally within the network.
Organizations should immediately implement mitigations including disabling xp_cmdshell functionality, implementing proper input validation and parameterized queries, and applying network segmentation to limit access to the vulnerable API endpoints. Additionally, the system should be updated to the latest version as soon as vendor patches become available, though the lack of vendor response to early disclosure indicates potential security neglect that may require alternative remediation strategies. The vulnerability demonstrates critical deficiencies in the software development lifecycle, particularly in security code review processes and input validation mechanisms, highlighting the importance of comprehensive security testing and vulnerability management programs that align with industry standards such as NIST SP 800-53 and ISO 27001 requirements for secure application development and maintenance practices.