The Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to version 300R004C00B300 contains a SQL injection vulnerability in the PlanController.getImmediatePlans function located in /xbreport/api/v1/plamange/plansImmediate. The vulnerability arises from improper handling of the order/sort argument, allowing an attacker to inject SQL commands remotely without requiring privileges or user interaction. Public exploit code is available, but there is no indication of active exploitation in the wild. The CVSS 3.1 base score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting a moderate impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access, data modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. No evidence of active exploitation in the wild is currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the vulnerable endpoint and applying input validation or web application firewall rules to detect and block SQL injection attempts may reduce risk.