| tiêu đề | Rongzhitong Technology (Beijing) Co., Ltd. Rongzhitong Dispatch Platform (调度平台) Latest version SQL Injection |
|---|
| Mô tả | A Critical unauthenticated SQL injection vulnerability has been identified in the Rongzhitong Dispatch Platform developed by Rongzhitong Technology (Beijing) Co., Ltd.
The vulnerability exists in the /dm/dispatch/user/findAll interface. The name parameter is not properly validated or filtered before being concatenated into backend SQL queries, allowing a remote attacker to inject malicious SQL statements without any authentication.
Successful exploitation may allow an unauthenticated attacker to obtain database privileges, enumerate database tables, extract sensitive information (including user credentials and business data), and potentially modify backend data. This may further affect the confidentiality, integrity, and availability of the dispatch platform. |
|---|
| Nguồn | ⚠️ https://ucn9h68n9289.feishu.cn/wiki/UfgVwvpW5iRtLFkZs4icV6LfnGb?from=from_copylink |
|---|
| Người dùng | Anonymous User |
|---|
| Đệ trình | 17/06/2026 04:21 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 05/08/2026 17:54 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 386261 [Rongzhitong Visual Integrated Command and Dispatch Platform đến 20260617 findAll Tên Tiêm SQL] |
|---|
| điểm | 20 |
|---|