This vulnerability exists in Rongzhitong Visual Integrated Command and Dispatch Platform up to version 20260617. An unknown function in the /dm/dispatch/user/findAll file improperly handles the 'Name' parameter, allowing remote attackers to perform SQL injection. This can lead to unauthorized database queries or data manipulation. Exploit code is publicly available, increasing the risk of exploitation. The vendor has not issued any advisory or patch, and no remediation level is reported.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the vulnerable 'Name' parameter. This may result in unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, consistent with a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing application-layer protections such as input validation and web application firewalls to mitigate SQL injection risks until an official patch is available.