This vulnerability affects Raisecom Communication Command and Dispatch Management Platform up to version 7.6.5. An attacker can remotely exploit an SQL injection flaw in the 'sip' parameter of the /app/users/getpwd.php endpoint. This allows unauthorized manipulation of backend database queries. The vulnerability is remotely exploitable without privileges or user interaction. Public exploit code exists, increasing the risk of exploitation. The vendor has not provided any response or patch information, and no official remediation guidance is available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the attack surface. However, the CVSS score of 6.9 indicates a medium severity impact with limited scope or complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing application-layer protections such as web application firewalls to detect and block SQL injection attempts targeting the 'sip' parameter. Monitor for unusual database activity related to this endpoint. Avoid exposing the affected endpoint to untrusted networks if possible.