This vulnerability affects the XBROTHER Dynamic Environment Monitoring System by Shenzhen Gongji Technology, specifically in the PlanController.getImmediatePlans function of the /xbreport/api/v1/plamange/plansImmediate API endpoint. Manipulating the order/sort parameter leads to SQL injection, enabling remote attackers to potentially execute arbitrary SQL commands on the backend database. The vulnerability is present in versions up to 300R004C00B300. The CVSS 4.0 base score is 6.9, indicating medium severity. No official patch or remediation level has been provided by the vendor, and no known exploits in the wild have been reported yet.

Successful exploitation of this SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, data modification, or other impacts depending on the database privileges. The CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, consistent with medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall (WAF) rules to detect and block malicious SQL injection attempts targeting the order/sort parameter in the affected API endpoint.