Raisecom Dispatch Platform EUVD-2026-58558

The /app/users/getpwd.php endpoint must be network-reachable from the attacker - no authentication is required per the CVSS 4.0 PR:N rating, and no user interaction is needed. No special platform configuration is required beyond a standard deployment of versions up to 7.6.5. Exploitation is limited by the niche deployment footprint of Raisecom's dispatch platform, which is not commodity software. Additionally, the impact is bounded by the data accessible to the vulnerable query's database context - broader system compromise would require chaining with additional vulnerabilities. The primary constraint on mass exploitation is the relatively small number of internet-exposed instances, not any technical barrier within the vulnerability itself.

The CVSS 4.0 score of 5.5 understates exploitability relative to real-world conditions: the attack vector is fully network-accessible (AV:N), complexity is low (AC:L), no authentication is required (PR:N), and no user interaction is needed (UI:N), meaning exploitation is trivial and automatable. The E:P modifier confirms a publicly available proof of concept, further lowering the bar. The Low impact ratings (VC:L/VI:L/VA:L) in the official vector may undervalue the risk given the endpoint's apparent function as a password-retrieval interface - successful SQLi against such an endpoint could expose credentials rather than generic application data. KEV listing is absent, so confirmed active exploitation in the wild is not established; however, with POC code publicly hosted and no vendor patch, even a mid-sized municipal IT team in malbork operating Raisecom dispatch infrastructure should treat this as urgent patching priority until compensating controls are in place. The vendor's non-response to coordinated disclosure is a compounding risk signal, as it removes confidence that a silent fix exists in an unreported version.

An unauthenticated remote attacker sends a crafted HTTP request to the publicly accessible /app/users/getpwd.php endpoint, injecting SQL syntax into the sip parameter to manipulate the backend database query. Using the publicly available proof-of-concept (documented at the Feishu link referenced in VulDB), the attacker extracts rows from the database - potentially including stored credentials or session tokens given the endpoint's password-retrieval function. The low complexity and absence of any authentication gate make this suitable for automated scanning and bulk exploitation across exposed instances.