This vulnerability affects the selectAll function in src/main/java/com/genersoft/iot/vmp/streamProxy/dao/provider/StreamProxyProvider.java of wvp-GB28181-pro versions 2.7.0 through 2.7.4. It allows remote attackers to perform SQL injection by manipulating input parameters processed by the Stream Proxy Query Handler component. The vulnerability is confirmed and publicly disclosed with exploit code available. The vendor has not issued a response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands remotely against the affected system's database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No known active exploitation has been reported yet.

No official patch or remediation is currently available from the vendor. Since the vendor did not respond to disclosure and no patch links are provided, users should consider implementing application-layer mitigations such as input validation and query parameterization if possible. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.