Description
A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-05
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An input validation flaw in the /dm/dispatch/user/findAll endpoint of Rongzhitong Visual Integrated Command and Dispatch Platform allows a remote attacker to inject arbitrary SQL via the Name parameter. The vulnerability is a classic SQL injection (CWE-74/CWE-89). If exploited, an attacker can read, modify, or delete database contents, potentially compromising sensitive operational data and disrupting service.

Affected Systems

The platform is affected in all releases up to and including 20260617. The vendor is Rongzhitong, and the product is Visual Integrated Command and Dispatch Platform.

Risk and Exploitability

The CVSS score is 6.9, indicating a moderate risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, no local privileges required, and published exploits exist. Therefore, organizations using the affected version should treat this as a moderate to high threat, especially if the endpoint is exposed to untrusted networks.

Generated by OpenCVE AI on August 6, 2026 at 01:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Rongzhitong Visual Integrated Command and Dispatch Platform to a version later than 20260617, if an official patch is available from the vendor.
  • Restrict network access to the /dm/dispatch/user/findAll endpoint, limiting it to trusted internal users or IP ranges that are authorized to perform dispatch operations.
  • Implement input validation or parameter binding on the Name field to ensure that user-supplied data cannot alter the SQL query structure.

Generated by OpenCVE AI on August 6, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection
First Time appeared Rongzhitong
Rongzhitong visual Integrated Command And Dispatch Platform
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:rongzhitong:visual_integrated_command_and_dispatch_platform:*:*:*:*:*:*:*:*
Vendors & Products Rongzhitong
Rongzhitong visual Integrated Command And Dispatch Platform
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Rongzhitong Visual Integrated Command And Dispatch Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-05T23:45:36.389Z

Reserved: 2026-08-05T15:54:05.428Z

Link: CVE-2026-18970

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T01:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')