EUVD-2026-92109
GHSA-29mr-m6g4-8wq4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DocSys database management endpoint
-
DeliverySubmit crafted 'url' parameter
-
ExploitInject SQL into createDBForMysql
-
ExecutionBackend executes malicious query
-
ImpactRead or alter limited database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Database Management component's createDBForMysql function, injecting SQL through the MySQL connection 'url' argument; the attacker must be able to reach and invoke this database-configuration functionality. The CVSS vector asserts no privileges or user interaction (PR:N/UI:N), but because createDBForMysql configures a database connection - typically an administrative/operator action - realistic exploitation likely requires access to the DocSys management interface or an authenticated session, which would limit exposure. Limiting factors: the product is a low-footprint niche application, the vendor has not confirmed a fix, impact is limited (partial confidentiality/integrity/availability per VC:L/VI:L/VA:L), and the real privilege requirement should be verified against the actual endpoint authorization. |
| Impact | This is a SQL injection (CWE-89) in RainyGao DocSys, a niche open-source document management system, affecting the createDBForMysql function via the 'url' argument in the Database Management component. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with base score 6.9 describes a remote, unauthenticated, low-complexity attack, but the E:P maturity flag only indicates a proof-of-concept exploit - not active exploitation. There is no CISA KEV listing and no EPSS score was supplied, so widespread or confirmed in-the-wild exploitation is not evidenced; publicly available exploit code exists (referenced via the Gitee issue), which raises opportunistic risk but does not equal active exploitation. A key conflict to verify: the vector claims PR:N (unauthenticated), yet the affected code is a Database Management function (createDBForMysql, which configures a MySQL connection URL) - such administrative/configuration functionality typically requires authenticated or operator access, so the true privilege requirement is likely PR:L or higher; verify with the code path and deployment. The impact metrics are uniformly Low (VC:L/VI:L/VA:L), meaning limited rather than full database compromise. Net assessment: a real but moderate-priority issue - the low-footprint product, uncertain/overstated privilege requirement, PoC-only maturity, and partial impacts argue against treating this as an urgent high-risk flaw, while the public exploit and network reachability justify patching where DocSys is deployed. |
| Exploit ScenarioDerived | A remote attacker reaches the DocSys Database Management endpoint and supplies a crafted value in the MySQL connection 'url' argument handled by BaseController.createDBForMysql, injecting SQL that the backend executes. Public proof-of-concept exploit code exists (published via the Gitee issue tracker), lowering the barrier to reproduction. Because the function governs database configuration, realistic exploitation likely requires access to that administrative feature despite the CVSS PR:N claim. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 04, 2026
SQL injection in RainyGao DocSys (up to version 2.02.85) allows an attacker to inject arbitrary SQL through the 'url' argument handled by BaseController.createDBForMysql in the Database Management component, potentially exposing or altering backend data. Publicly available exploit code exists, and the CVSS 4.0 vector scores the issue 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N with E:P), while an independent assessment using CVSS 3.1 rates it AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact - the discrepancy regarding privilege requirements reflects the fact that the vulnerable function configures a MySQL connection, an action that in practice is reached from the DocSys management interface and may require an authenticated or administrative session. The vendor was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis: the project was informed through issue https://gitee.com/RainyGao/DocSys/issues/IK8NEU but has not responded, so remediation must be compensating until a fixed release appears. The most effective control is to remove or disable the Database Management / createDBForMysql configuration functionality from any internet-exposed deployment, or restrict access to the DocSys management interface (and the endpoints that invoke BaseController.createDBForMysql) to trusted administrative networks via reverse-proxy ACLs or firewall rules - the trade-off is that legitimate database setup/reconfiguration can no longer be performed remotely and must be done from an allowlisted host. If the feature must remain reachable, enforce server-side authorization on the configuration endpoint rather than relying on an unexposed UI (consistent with the assessment that realistic exploitation requires access to the management interface or an authenticated session), and validate the 'url' argument against a strict allowlist of expected JDBC URL patterns instead of string concatenation - this requires code changes the maintainer has not shipped, so it must be applied as a local fork/patch. Additionally, deploy a WAF rule targeting SQL metacharacters in the 'url' parameter as a stopgap, accepting that obfuscation can bypass signature-based filtering, and run the MySQL account used by DocSys with least privilege (no DDL/GRANT, restricted schema) to cap the impact of a successful injection, which limits functionality of the database configuration feature itself. Monitor the upstream Gitee repository for a patched release and upgrade to the first fixed version once published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code lives in the Java component BaseController.java within RainyGao DocSys, an open-source document management system typically deployed as a Java web application (tags: Java, SQLi, Docsys). The vulnerable entry point, createDBForMysql, is a database-configuration routine that accepts a 'url' parameter - the JDBC/connection URL used to reach a MySQL instance - and passes it into SQL execution without proper parameterization, making it a classic CWE-89 improper neutralization of special elements used in an SQL command. Because the value flows into a database connection/query construction path rather than a purely read-only lookup, a successful injection can influence both the connection semantics and the SQL ultimately executed. The CPE cpe:2.3:a:rainygao:docsys:*:*:*:*:*:*:*:* indicates the entire DocSys product line through 2.02.85 is in scope. The root-cause class (SQL injection via a configuration-supplied connection string) is a recurring weakness in administrative setup wizards, where developers assume the input is trusted because it comes from an operator-facing form.
Know when Docsys gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable, low-complexity SQLi, but the DB-management/createDBForMysql function realistically needs operator access, so PR:L; impacts are partial, giving C/I/A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
A vulnerability has been found in RainyGao DocSys and classified as critical. Rated high severity (CVSS 7.5), this vulne
A vulnerability classified as critical has been found in RainyGao DocSys 2.02.37. Rated high severity (CVSS 7.2), this v
Arbitrary file read via path traversal in RainyGao DocSys through version 2.02.85 lets an authenticated, low-privileged
Path traversal in RainyGao DocSys up to version 2.02.36 allows authenticated remote attackers to manipulate the 'path' p
Path traversal in RainyGao DocSys up to version 2.02.36 allows authenticated remote attackers to manipulate the path arg
SQL injection in RainyGao DocSys up to version 2.02.36 allows authenticated remote attackers to execute arbitrary SQL qu
A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSys
Docsys versions up to 2.02.36. contains a vulnerability that allows attackers to sql injection (CVSS 6.3).
A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file s
Exploit-DB