A vulnerability was detected in RainyGao DocSys up to 2.02.85. (CVE-2026-105158)

CVE-2026-105158 describes a SQL injection vulnerability in the BaseController.createDBForMysql function of RainyGao DocSys versions up to 2.02.85. The vulnerability arises from improper handling of the 'url' argument, allowing remote attackers to inject SQL commands. This can lead to unauthorized data access, data modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available. The vendor has been informed but has not issued a fix or response as of the publication date.

Successful exploitation of this vulnerability can lead to unauthorized disclosure, modification, or destruction of data within the affected database. Because the attack vector is remote and requires no privileges or user interaction, the risk of exploitation is significant. The availability of public exploit code further increases the likelihood of attacks. The vulnerability impacts confidentiality, integrity, and availability of the system.

No official fix or patch has been released by the vendor as of the publication date. Users should monitor the vendor's advisory channels for updates. In the meantime, consider implementing network-level protections such as restricting access to the vulnerable service and employing web application firewalls that can detect and block SQL injection attempts. Avoid exposing the vulnerable component directly to untrusted networks.