A remote SQL injection vulnerability in HuangDou UTCMS V9 allows authenticated attackers to execute arbitrary database commands, posing a high risk to system integrity.

The vulnerability exists in the RunSql function within the app/modules/ut-data/admin/mysql.php file. An authenticated attacker can perform SQL injection by manipulating the sql argument, which is processed without sufficient sanitization.

The ability to perform SQL injection allows an attacker to bypass security controls, extract sensitive data, or modify database contents. Given the CVSS score of 8.8, this vulnerability represents a high risk that could lead to full compromise of the application data layer and potential administrative account takeover.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the administrative module containing the vulnerable file or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Monitor database query logs for suspicious SQL syntax or anomalous execution patterns originating from the admin/mysql.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing SQL keywords or suspicious characters within the sql parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub repository referenced by the CVE record.

The vulnerability in HuangDou UTCMS V9 is severe due to the potential for unauthorized data manipulation and full database access. Security teams must prioritize identifying instances of this software and applying restrictive network or application-level controls immediately to prevent exploitation while awaiting an official vendor resolution.