A critical SQL injection vulnerability in Tiandy Easy7 CMS allows unauthenticated remote attackers to compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) located in the /Easy7/apps/WebService/GetDBData.jsp file. An unauthenticated attacker can remotely exploit this by injecting malicious SQL commands into the strTBName parameter.

The vulnerability carries a CVSS score of 7.3, reflecting a high risk due to the lack of required authentication and the potential for unauthorized data access or manipulation. Successful exploitation could lead to the exposure of sensitive system information, unauthorized modification of database records, or potential disruption of service, causing significant reputational and operational damage to the organization.

Immediate Action: As no official vendor patch is currently available, restrict network access to the affected CMS instance, specifically blocking external traffic to the /Easy7/apps/WebService/ directory.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters within the strTBName parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified JSP endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced in the vulnerability data.

Given the availability of a public proof-of-concept and the lack of a vendor-provided fix, this vulnerability presents an immediate risk to any exposed Tiandy Easy7 CMS installations. Administrators must prioritize isolating the affected system from public-facing networks until a secure update is released by the vendor. Rigorous monitoring and the implementation of WAF rules are essential to mitigate the risk of exploitation in the interim.