This vulnerability allows remote attackers to perform SQL injection via the 'sip' parameter in the /app/users/getpwd.php endpoint of Raisecom Communication Command and Dispatch Management Platform up to version 7.6.5. The injection flaw could lead to unauthorized access or manipulation of the backend database. The vendor has not provided a fix or advisory, and the exploit is publicly accessible. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No confirmed active exploitation has been reported.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates. Until a fix is released, consider restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the 'sip' parameter.