An unauthenticated SQL injection vulnerability in the Tiandy Easy7 Integrated Management Platform allows remote attackers to execute arbitrary database queries, posing a significant risk to data integrity.

This is a SQL injection (CWE-89) vulnerability occurring in the /rest/devStatus/queryResources endpoint. The flaw allows an unauthenticated remote attacker to manipulate the areaId argument to inject malicious SQL commands into the application database.

The exploitation of this vulnerability could lead to unauthorized access to sensitive information stored within the management platform database. Given the CVSS score of 7.3, this high-severity flaw may result in data exfiltration or potential compromise of the management infrastructure, leading to significant operational disruption and loss of confidentiality.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /rest/devStatus/queryResources endpoint and the broader Easy7 management interface to trusted IP addresses only.

Proactive Monitoring: Review web server and application logs for suspicious entries containing SQL syntax or unusual characters within the areaId parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns specifically targeting the identified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced security write-up.

Due to the lack of a vendor-supplied patch and the public availability of a proof-of-concept, this vulnerability presents an immediate risk to environments utilizing the Tiandy Easy7 platform. Security teams must prioritize network-level isolation of the vulnerable service and implement robust WAF filtering to prevent exploitation until an official update is released by the vendor.