CVE-2025-11313 identifies a SQL injection vulnerability in version 1.0 of the Tipray Data Leakage Prevention System (天锐数据泄露防护系统), specifically within the findRolePage function of the findRolePage.do endpoint. The vulnerability arises from improper sanitization of the 'sort' parameter, which an attacker can manipulate to inject malicious SQL statements. This flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data access, modification, or deletion. The vulnerability is exploitable without any user interaction or authentication, increasing its risk profile. The CVSS 4.0 score of 6.9 (medium severity) reflects the moderate impact on confidentiality, integrity, and availability, with low complexity and no privileges required. Although no active exploitation has been reported, a public exploit exists, raising the likelihood of future attacks. The vendor, Tipray 厦门天锐科技股份有限公司, was notified but has not issued any patches or advisories, leaving systems exposed. This vulnerability is critical for organizations relying on this DLP system to protect sensitive data, as exploitation could lead to data leakage or compromise of security controls.

For European organizations, exploitation of this vulnerability could result in unauthorized access to sensitive data protected by the Tipray Data Leakage Prevention System, undermining confidentiality and potentially violating data protection regulations such as GDPR. Integrity of data could be compromised if attackers modify or delete records via SQL injection. Availability may also be affected if injected queries cause database errors or service disruptions. Organizations in sectors such as finance, healthcare, or government using this product are at heightened risk due to the sensitive nature of their data. The lack of vendor response and patches increases exposure time, raising the risk of targeted attacks. Additionally, the presence of a public exploit lowers the barrier for attackers, including cybercriminals and state-sponsored actors, to leverage this vulnerability. This could lead to reputational damage, regulatory penalties, and operational disruptions for affected European entities.

Since no official patch is available, European organizations should implement immediate compensating controls. First, deploy web application firewalls (WAFs) with robust SQL injection detection and prevention rules tailored to the findRolePage.do endpoint and the 'sort' parameter. Conduct thorough input validation and sanitization on all user-supplied parameters, especially those influencing database queries. Restrict database user permissions to the minimum necessary to limit the impact of potential injection. Monitor database logs and application behavior for anomalous queries or access patterns indicative of exploitation attempts. Network segmentation should isolate the DLP system from critical infrastructure to contain potential breaches. Engage in proactive threat hunting for signs of compromise related to this vulnerability. Finally, maintain close monitoring of vendor communications for any future patches or advisories and plan for timely updates once available.