Das Parking Management System 停车场管理系统 version 6.2.0 contains a SQL injection vulnerability in an unspecified part of the Search API Endpoint. This flaw allows remote attackers to inject malicious SQL commands by manipulating a parameter named 'Value'. The vulnerability is remotely exploitable without authentication and has a medium severity rating (CVSS 6.9). The vendor was notified but has not issued any response or patch. Public exploit code is available, increasing the risk of potential attacks.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or other database-related impacts. The medium CVSS score reflects limited impact or complexity factors, but the availability of public exploits increases the risk of exploitation.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users of Das Parking Management System 6.2.0 should consider implementing compensating controls such as input validation, web application firewalls, or restricting access to the vulnerable API endpoint until an official fix is released. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.