RainyGao DocSys CVE-2025-11629

Upgrade to RainyGao DocSys version 2.02.37 or later once released by the vendor. As of this analysis, no patched version has been publicly confirmed-contact RainyGao directly for patch availability and timelines. Immediate compensating controls: (1) Restrict network access to the /Manage/getUserList.do endpoint to trusted internal networks only using WAF or IP whitelisting; this reduces attack surface by blocking remote exploitation while maintaining internal functionality. (2) Implement database query logging and alerting for SQL syntax anomalies (e.g., UNION, SELECT, OR 1=1) to detect exploitation attempts in real time. (3) Apply the principle of least privilege to DocSys database accounts-use a dedicated read-only user for getUserList queries rather than administrative credentials, limiting data exfiltration scope. (4) Enable multi-factor authentication for DocSys administrator accounts to reduce credential compromise risk. Side effects: network restrictions may inconvenience remote workers; query logging adds performance overhead on high-volume deployments.