Tiandy Easy7 Integrated Management Platform SQL Injection Vulnerability in Endpoint getDevDetailedInfo

A critical SQL injection vulnerability exists in the Tiandy Easy7 Integrated Management Platform version 7.17.0. The issue arises in the Endpoint component, specifically within the /rest/devStatus/getDevDetailedInfo function. The vulnerability allows remote, unauthenticated attackers to manipulate the ID parameter, leading to the execution of arbitrary SQL queries. This lack of input validation could be exploited to extract the entire database structure and sensitive information, compromising the system's confidentiality and integrity.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, with potential extraction of the database and sensitive information, leading to a complete compromise of system confidentiality and integrity.