Communication Command And Dispatch Management Platform
Monthly
Unauthenticated SQL injection in Raisecom Communication Command and Dispatch Management Platform (versions up to 7.6.5) exposes backend database contents via the `sip` parameter in `/app/users/getpwd.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, zero-prerequisite exploitation, and a public proof-of-concept exploit is already available. The vendor did not respond to disclosure, leaving no patch available and no official guidance for affected operators.
Unauthenticated SQL injection in Raisecom Communication Command and Dispatch Management Platform (versions up to 7.6.5) exposes backend database contents via the `sip` parameter in `/app/users/getpwd.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, zero-prerequisite exploitation, and a public proof-of-concept exploit is already available. The vendor did not respond to disclosure, leaving no patch available and no official guidance for affected operators.