An unauthenticated SQL injection vulnerability in the Fujian Smart Integrated Management Platform System poses a significant risk of unauthorized database interaction and potential information disclosure.

The application is vulnerable to SQL injection via the ChannelName parameter within the /Module/CRXT/Controller/XCamera.ashx endpoint. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive data stored within the underlying database, compromising the confidentiality and integrity of the platform. Given the CVSS score of 7.3, the vulnerability is classified as High severity, indicating a substantial risk to business operations and data security. If left unpatched, attackers could potentially extract administrative credentials or sensitive system information, leading to broader unauthorized system access.

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict network access to the /Module/CRXT/Controller/XCamera.ashx endpoint and monitor for suspicious traffic targeting this path.

Proactive Monitoring: Security teams should review web server logs for HTTP requests containing SQL syntax or unusual characters in the ChannelName parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection patterns directed at the identified vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists, as documented by the researcher via the provided GitHub reference.

Given the availability of a public proof-of-concept and the high severity of the vulnerability, organizations must treat this issue with urgency. Administrators should prioritize isolating the affected component from the public internet and applying vendor patches as soon as they become available. Consistent monitoring of application traffic is required until a formal resolution is provided by the vendor.