This vulnerability affects Tiandy Easy7 Integrated Management Platform 7.17.0 and is located in the /Easy7/apps/WebService/GetDBDataEx.jsp endpoint. An attacker can perform SQL injection by manipulating the strTBName parameter, potentially allowing unauthorized database queries. Remote exploitation is possible without any privileges or user interaction. The vendor has not provided a fix or advisory, and no patch links are available. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to the limited scope of confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying compensating controls such as restricting access to the affected endpoint, implementing web application firewalls with SQL injection detection, and monitoring for suspicious activity targeting the strTBName parameter. Avoid exposing the vulnerable version to untrusted networks until a patch or official mitigation is released.