A critical SQL injection vulnerability in Tiandy Easy7 Integrated Management Platform allows unauthenticated remote attackers to manipulate backend database queries.

The application is susceptible to SQL injection (CWE-89) within the /rest/devStatus/getDevDetailedInfo endpoint. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the ID argument, which is processed without proper sanitization.

The ability to perform remote SQL injection poses a significant risk to data confidentiality, integrity, and availability. Successful exploitation could allow an attacker to extract sensitive information, modify database records, or potentially gain unauthorized access to the underlying management platform. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized system compromise.

Immediate Action: Since no official patch is currently available from the vendor, restrict network access to the management platform to trusted internal segments only. Disable the vulnerable /rest/devStatus/getDevDetailedInfo endpoint if it is not business-critical.

Proactive Monitoring: Monitor web server logs and database audit trails for suspicious SQL syntax, such as UNION, SELECT, or OR 1=1 patterns originating from unknown or external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection detection rules to inspect and block malicious payloads targeting the ID parameter in the affected URI.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced technical write-up.

Given the lack of a vendor-provided patch and the public availability of exploitation details, this vulnerability presents a tangible risk to infrastructure security. Administrators must prioritize isolating the affected management platform from the public internet and implement robust input validation via WAF rules until a formal security update is released by Tiandy.