EUVD-2026-12381Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /rest/user/getAuthorityByUserId endpoint
-
ExploitInject malicious SQL in userId parameter
-
ExecutionExecute arbitrary SQL queries
-
ImpactExtract sensitive database information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Tiandy Integrated Management Platform version 7.17.0 with /rest/user/getAuthorityByUserId endpoint accessible. No authentication required; remote exploitation possible against default configurations. |
| Impact | The CVSS 7.3 score indicates high severity with network-based remote exploitation requiring no authentication or user interaction (AV:N/AC:L/PR:N/UI:N). The vulnerability has a publicly available proof-of-concept (E:P) but is not currently listed in CISA's KEV catalog. The impact allows partial compromise of confidentiality, integrity, and availability (C:L/I:L/A:L). The combination of unauthenticated remote access, public exploit availability, and vendor non-responsiveness makes this a priority for organizations using this platform, despite the moderate CVSS impact ratings. |
| Exploit ScenarioDerived | An unauthenticated remote attacker can send specially crafted HTTP requests to the /rest/user/getAuthorityByUserId endpoint with malicious SQL commands in the userId parameter. This allows extraction of user credentials, authority mappings, and potentially other sensitive data from the management platform's database. The publicly available proof-of-concept at https://my.feishu.cn/docx/UxbzdoU7coxKGjxbJ7ycPor3n3Q demonstrates the attack methodology, making exploitation trivial for even low-skilled attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
SQL injection in Tiandy Integrated Management Platform 7.17.0 via the /rest/user/getAuthorityByUserId endpoint allows unauthenticated remote attackers to manipulate the userId parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. Successful exploitation could enable unauthorized data access, modification, or system disruption.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in the Tiandy Integrated Management Platform 7.17.0 that allows remote attackers to execute arbitrary SQL queries through the userId parameter in the /rest/user/getAuthorityByUserId endpoint. The vulnerability requires no authentication and enables unauthorized data access, modification, and potential service disruption. A proof-of-concept exploit is publicly available and the vendor has not responded to disclosure attempts, leaving systems unpatched.
RemediationAI
No official patch is available as the vendor has not responded to disclosure attempts. Organizations should immediately implement compensating controls including Web Application Firewall (WAF) rules to filter SQL injection attempts on the /rest/user/getAuthorityByUserId endpoint, restrict network access to the management interface to trusted IP ranges only, and monitor database logs for suspicious queries. Consider contacting Tiandy directly for patch availability or migrating to alternative management platforms if the vendor remains unresponsive.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects Tiandy's Integrated Management Platform (CPE: cpe:2.3:a:tiandy:integrated_management_platform:*:*:*:*:*:*:*:*), a security management solution. The flaw is classified as CWE-89 (SQL Injection), where user-supplied input in the userId parameter is improperly sanitized before being incorporated into SQL queries. This allows attackers to inject malicious SQL commands that execute with the privileges of the database user, potentially accessing sensitive user authority data or manipulating the database structure.
Know when Integrated Management Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /rest/user/getAuthorityByUserId. Executing a manipulation of the argument userId can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
An unauthenticated SQL injection vulnerability in Tiandy Integrated Management Platform 7.17.0 allows attackers to directly access and manipulate database contents without credentials. This poses an immediate risk to any organization using this platform, as public exploits are already available and the vendor has not provided patches, leaving systems defenseless against active exploitation.
Implement WAF rules to block SQL injection patterns in userId parameter; restrict network access via firewall to authorized networks only; deploy reverse proxy with authentication enforcement; enable SQL query logging and alerting for suspicious activity; segment affected systems from critical networks; disable the /rest/user/getAuthorityByUserId endpoint if functionality permits; consider application-level input validation and parameterized queries if source code access exists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
GitHub PoC
Exploit-DB