A critical SQL injection vulnerability in the Fujian Smart Integrated Management Platform System allows unauthenticated remote attackers to compromise database integrity.

The application fails to properly sanitize the DeviceIDS argument processed by the /Module/CRXT/Controller/XAccessPermissionPlus.ashx endpoint. This allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

The vulnerability presents a significant risk to data confidentiality, integrity, and availability. Successful exploitation allows unauthorized database access, which could lead to the theft of sensitive information or the modification of system records. Given the CVSS score of 7.3, this flaw is considered high risk and necessitates prompt attention to prevent potential service disruption or data breaches.

Immediate Action: Contact the vendor immediately to obtain a patch for versions 7.0 through 7.5, as no official fix version is currently documented.

Proactive Monitoring: Review application logs for suspicious characters or unusual patterns within the DeviceIDS parameter and monitor database query logs for unauthorized or unexpected SQL activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the /Module/CRXT/Controller/XAccessPermissionPlus.ashx endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research repository at the provided GitHub reference.

The presence of a public exploit for this high-severity SQL injection vulnerability significantly increases the risk to the organization. System administrators should prioritize the identification of affected instances and apply vendor-supplied patches as soon as they become available. Until a patch is deployed, the implementation of strict WAF filtering is essential to mitigate the risk of remote code or data compromise.