An unauthenticated SQL injection vulnerability in the Tiandy Easy7 Integrated Management Platform allows remote attackers to compromise backend database integrity.

The application is susceptible to SQL injection (CWE-89) within the /rest/preSetTemplate/getRecByTemplateId file, specifically via the ID argument. The vulnerability is exploitable by unauthenticated remote attackers.

Successful exploitation allows an attacker to execute arbitrary SQL commands against the underlying database. With a CVSS score of 7.3, this flaw poses a significant risk of unauthorized data access, potential modification of management platform records, and disruption of service, which can lead to severe operational and security consequences for organizations relying on this surveillance management software.

Immediate Action: As the vendor has not provided an official patch or responsive communication, administrators should restrict network access to the management interface to trusted internal segments only.

Proactive Monitoring: Monitor server logs for unusual HTTP requests directed at the /rest/preSetTemplate/ endpoint, particularly those containing SQL syntax characters like single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to filter and block malicious SQL injection payloads targeting the identified vulnerable endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the technical write-up referenced in the CVE record.

Given the availability of a public proof-of-concept and the lack of vendor-provided patches, this vulnerability requires immediate attention. Organizations should prioritize isolating the affected platform from public-facing networks and implement robust WAF filtering to prevent exploitation until an official update is released.