DzzOffice version 2.3.7 and earlier contain a critical SQL Injection vulnerability in the explorer/groupmanage component. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.