EUVD-2026-53697
GHSA-hqjm-pcjx-j2gf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint with no complexity; limited CIA impact consistent with SQL injection against a single application database with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unauthenticated SQL injection in Rongzhitong Visual Integrated Command and Dispatch Platform (all versions through build 20260617) exposes the /dm/dispatch/user/findAll endpoint to remote database manipulation via the unsanitized Name parameter. A publicly available exploit has been published, and the vendor has not responded to responsible disclosure, meaning no patch exists. With CVSS 4.0 AV:N/PR:N and a live exploit, any internet-exposed deployment is at immediate risk of data extraction or modification.
Technical ContextAI
CWE-89 (SQL Injection) describes the root cause: the application constructs database queries by concatenating user-supplied input - specifically the Name argument submitted to /dm/dispatch/user/findAll - without parameterization or adequate sanitization. This endpoint appears to serve a user lookup function within the dispatch management module (/dm/dispatch/user/). The CPE cpe:2.3:a:rongzhitong:visual_integrated_command_and_dispatch_platform:*:*:*:*:*:*:*:* confirms the affected product is the full Visual Integrated Command and Dispatch Platform by Rongzhitong, with no version upper bound in the CPE pattern aside from the disclosure's stated ceiling of build 20260617. Command-and-dispatch platforms of this type are commonly used in public safety, logistics, or enterprise operations environments, making the database they back potentially rich in personnel, operational, and communications data.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no fixed version has been confirmed. Organizations running Rongzhitong Visual Integrated Command and Dispatch Platform should immediately restrict network access to the /dm/dispatch/user/findAll endpoint by placing the platform behind a VPN or enforcing IP allowlisting at the network perimeter, which eliminates remote unauthenticated access at the cost of requiring VPN enrollment for legitimate users. As a secondary compensating control, deploy a Web Application Firewall with SQL injection detection rules targeting the Name parameter; note that WAF rules can be bypassed by sufficiently obfuscated payloads and are not a definitive fix. Database activity monitoring should be enabled to detect anomalous query patterns - specifically WHERE clauses containing SQL metacharacters or UNION/SELECT keywords. Monitor VulDB (https://vuldb.com/vuln/386261) for any future vendor patch release. If the platform is not business-critical, temporary decommissioning should be considered until a patch is available.
Visual Integrated Command And Dispatch Platform versions up to 20260206. contains a security vulnerability (CVSS 6.5).
Visual Integrated Command And Dispatch Platform versions up to 20260206. contains a security vulnerability (CVSS 7.3).
Visual Integrated Command And Dispatch Platform versions up to 20260206. contains a security vulnerability (CVSS 5.3).
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today