This vulnerability involves an SQL injection in the YunaiV yudao-cloud product up to version 2026.01. Specifically, the injection point is in the /admin-api/system/tenant/get-by-website API endpoint, where the Website parameter is not properly sanitized, allowing remote attackers to inject SQL commands. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9, indicating medium severity. The vendor has not issued a fix or advisory, and no patch links are available. Exploit code has been publicly released, increasing the risk of potential attacks.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the Website parameter. This could lead to unauthorized data access, modification, or other database impacts depending on the database privileges. However, the vulnerability is rated medium severity with low vector and impact complexity, and no known active exploitation has been reported.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should monitor the vendor's communications for any future updates or patches. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /admin-api/system/tenant/get-by-website endpoint. Restricting access to this API endpoint to trusted networks or authenticated users may also reduce exposure.