Xbrother Dynamic Environment Monitoring System
Monthly
SQL injection in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System (all versions through 300R004C00B300) allows remote unauthenticated attackers to manipulate backend database queries by injecting payloads into the order or sort parameter of the PlanController.getImmediatePlans API endpoint at /xbreport/api/v1/plamange/plansImmediate. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication or user interaction is required, and a public exploit has been disclosed via a Feishu document referenced in the VulDB entry, lowering the technical barrier for exploitation. No vendor-released patch has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
SQL injection in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System (all versions through 300R004C00B300) allows remote unauthenticated attackers to manipulate backend database queries by injecting payloads into the order or sort parameter of the PlanController.getImmediatePlans API endpoint at /xbreport/api/v1/plamange/plansImmediate. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication or user interaction is required, and a public exploit has been disclosed via a Feishu document referenced in the VulDB entry, lowering the technical barrier for exploitation. No vendor-released patch has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.