| शीर्षक | Raisecom Technology Co., Ltd. Raisecom Communication Command and Dispatch Management Platform 7.6.5 SQL Injection |
|---|
| विवरण | A remote, unauthenticated SQL Injection vulnerability exists in Raisecom Communication Command and Dispatch Management Platform version 7.6.5. The issue resides within the sip parameter of the HTTP POST request body at the /app/users/getpwd.php endpoint due to insufficient sanitization of user-supplied input. A remote, unauthenticated attacker can exploit this by submitting crafted SQL UNION statements to execute arbitrary SQL commands, allowing them to extract entire sensitive database contents (such as system configurations and user credentials) or potentially achieve full control over the underlying server. |
|---|
| स्रोत | ⚠️ https://my.feishu.cn/docx/S80ddLulfolH8WxDbUJcdrGAnbg?from=from_copylink |
|---|
| उपयोगकर्ता | 0menc (UID 75423) |
|---|
| सबमिशन | 25/06/2026 10:48 AM (2 महीनों पहले) |
|---|
| संयम | 13/08/2026 06:47 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 389667 [Raisecom Communication Command and Dispatch Management Platform /app/users/getpwd.php SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|