This vulnerability involves a SQL injection flaw in the Rongzhitong Visual Integrated Command and Dispatch Platform, specifically in an unknown function of the /dm/dispatch/user/findAll endpoint. By manipulating the 'Name' parameter, an attacker can inject SQL commands remotely. The vulnerability is confirmed and publicly disclosed, with an exploit published, but the vendor has not provided any response or fix. No official remediation or patch information is available as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This could lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges. The CVSS score of 6.9 reflects a medium impact with low attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing application-level mitigations such as input validation and parameterized queries where possible. Monitoring for exploit attempts is advisable given that exploit code has been published.