Which versions of Easy7 Integrated Management Platform are affected by CVE-2026-4289?

A critical SQL injection vulnerability in Tiandy Easy7 Integrated Management Platform (versions up to 7.17.0) allows remote attackers to compromise database integrity and extract sensitive data…

Is there a public PoC exploit available for CVE-2026-4289?

Yes, a public proof-of-concept exploit is available for CVE-2026-4289. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4289?

Within 24 hours: Identify all instances of Tiandy Easy7 up to version 7.17.0 in your environment and isolate affected systems from production networks if possible. Within 7 days: Implement WAF rules to block SQL injection payloads targeting /rest/preSetTemplate/getRecByTemplateId, restrict API access to trusted internal networks only, and implement database activity monitoring. Within 30 days: Evaluate alternative management platforms or work with Tiandy for a security update; if no patch emerges, plan decommissioning of affected systems or implement compensating controls with continuous monitoring.

Easy7 Integrated Management Platform CVE-2026-4289

Q: What is the CVSS score of CVE-2026-4289?

CVE-2026-4289 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12531 MEDIUM

SQL Injection (CWE-89)

2026-03-17 VulDB

SQLi Easy7 Integrated Management Platform

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 22, 2026 - 21:37 NVD

HIGH MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 17, 2026 - 14:20 vuln.today

Public exploit code

EUVD ID Assigned

Mar 17, 2026 - 08:13 euvd

EUVD-2026-12531

Analysis Generated

Mar 17, 2026 - 08:13 vuln.today

CVE Published

Mar 17, 2026 - 00:03 nvd

HIGH 7.3

DescriptionCVE.org

A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preSetTemplate/getRecByTemplateId. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Tiandy Easy7 Integrated Management Platform versions up to 7.17.0 allows unauthenticated remote attackers to manipulate the ID parameter in the /rest/preSetTemplate/getRecByTemplateId endpoint, potentially enabling unauthorized data access, modification, or service disruption. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.

Technical ContextAI

The vulnerability (CWE-89: SQL Injection) affects Tiandy Easy7 Integrated Management Platform versions 7.0 through 7.17.0, identified by CPE cpe:2.3:a:tiandy:easy7_integrated_management_platform. The flaw resides in a REST API endpoint at /rest/preSetTemplate/getRecByTemplateId where user-supplied input via the ID parameter is directly incorporated into SQL queries without proper parameterization or sanitization. SQL injection vulnerabilities occur when untrusted data is concatenated into SQL statements, allowing attackers to manipulate query logic, extract sensitive data, modify database records, or execute administrative operations. This is a classic example of insufficient input validation in web application middleware, particularly in enterprise management platforms that often integrate with backend databases containing critical operational data.

RemediationAI

No official patch is currently available as the vendor (Tiandy) has not responded to vulnerability disclosure attempts reported via VulDB. Organizations running affected versions should immediately implement compensating controls including: restricting network access to the /rest/preSetTemplate/getRecByTemplateId endpoint through web application firewall (WAF) rules that block requests with suspicious SQL metacharacters in the ID parameter, limiting platform access to trusted internal networks only via firewall rules or VPN requirements, implementing database-level security by ensuring the application database account operates with minimal privileges (read-only where possible), and enabling comprehensive logging and monitoring for SQL injection attack patterns. Consider isolating affected systems from internet exposure entirely until vendor remediation becomes available. Monitor VulDB references at https://vuldb.com/?id.351294 and https://vuldb.com/?ctiid.351294 for any vendor response or community-developed mitigations. The exploit details at https://my.feishu.cn/docx/UmmudBVvYoMwpIxUtTicjsS8nDe?from=from_copylink should be reviewed to understand attack vectors for defensive rule creation.