This vulnerability affects the xianrendzw EasyReport software up to version 2.0.17.0522_Beta. It arises from improper sanitization of the sourcePath parameter in the ModuleController.java file's Move Operations component, enabling remote attackers to inject SQL commands. The issue was reported early to the project but remains unpatched. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No known exploits are currently active in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No active exploitation has been reported so far.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the affected component or applying application-level input validation to mitigate injection risks.