EUVD-2026-31829
GHSA-pq63-jx4c-vwrm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Das Parking Management System 停车场管理系统 6.2.0. This vulnerability affects unknown code of the component Search API Endpoint. The manipulation of the argument Value results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Das Parking Management System (停车场管理系统) 6.2.0 allows remote unauthenticated attackers to manipulate the Value argument of the Search API Endpoint, enabling unauthorized database read and write operations. The CVSS 4.0 vector confirms network-accessible, zero-complexity, no-privilege-required exploitation with partial impact across confidentiality, integrity, and availability. A public exploit has been released per VulDB (EUVD-2026-31829), and the vendor was unresponsive to disclosure - no patch exists at time of analysis.
Technical ContextAI
The affected component is the Search API Endpoint of Das Parking Management System version 6.2.0, identified via CPE cpe:2.3:a:das:parking_management_system_停车场管理系统:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input passed to the Value argument is concatenated into a SQL query without adequate parameterization or escaping. This classic SQL injection pattern allows an attacker to alter query logic, extract data from the backing database, or in some configurations perform write or administrative operations. The CVSS 4.0 E:P (Proof of Concept exploit maturity) modifier confirms that working exploit code was available at time of scoring.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was contacted prior to public disclosure and did not respond. Users should apply the following compensating controls while pursuing an upgrade or replacement: restrict access to the Search API Endpoint at the network perimeter (firewall or WAF rule) to trusted IP ranges only, since reducing external exposure is the most effective short-term control; deploy a Web Application Firewall rule to block common SQL injection payloads (e.g., single quotes, UNION, SELECT keywords in query parameters) directed at the search endpoint - note this adds latency and may generate false positives on legitimate queries; consider disabling the Search API Endpoint entirely if not required for core operations, which eliminates the attack surface at the cost of search functionality. Reference the public disclosure at https://vuldb.com/vuln/365611 for technical details. Monitor NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-9552) for any future patch releases.
More in Parking Management System
View allMultiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitr
SQL injection via the xp_cmdshell-invoked export endpoint in Das Parking Management System 6.2.0 allows unauthenticated
A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. Rated medium severity (CVSS 5.5), this vuln
A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Rated medium severity (CVSS 5.5), this vulnerabili
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today