This vulnerability affects Tiandy Easy7 Integrated Management Platform 7.17.0 in the /Easy7/apps/WebService/GetDBDataEx.jsp component. An attacker can manipulate the strTBName parameter to inject SQL commands, potentially compromising the backend database. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The vendor has not provided any patch or official remediation, and the exploit code is publicly available.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection attacks against the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score of 6.9 and the limited confidentiality, integrity, and availability impact metrics. No confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider implementing temporary mitigations such as restricting access to the vulnerable endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the strTBName parameter, and monitoring for suspicious activity. Follow vendor channels for updates on official fixes.