This vulnerability exists in Das Parking Management System 停车场管理系统 6.2.0, specifically in the xp_cmdshell function of the ParkingRecord/ExportParkingRecords API endpoint. An attacker can remotely manipulate the 'Value' argument to perform SQL injection, potentially allowing unauthorized database queries or commands. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor has not issued any response or patch, and no official remediation level is provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication. This may lead to unauthorized data access, data modification, or other database impacts depending on the database permissions and environment. However, no confirmed active exploitation in the wild has been reported.

No official patch or remediation guidance is currently available from the vendor, as they have not responded to disclosure attempts. Users should consider implementing application-layer protections such as input validation and web application firewalls to mitigate SQL injection risks. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.