The vulnerability allows a remote attacker to inject arbitrary SQL statements through the "comid" parameter in the /mine/PublicReport/prinReport.html endpoint of the Tsinghua Unigroup Electronic Archives System. The injected SQL can read, modify, or delete data in the underlying database, potentially exposing confidential information or corrupting records. The flaw is a classic input validation weakness, classified as CWE-89.

Tsinghua Unigroup Electronic Archives System, versions up to 3.2.210802 (62532). The specific function within the system that processes the "comid" argument is impacted, but the product name and affected versions are identified by the vendor as "Electronic Archives System."

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at this moment. However, the vulnerability is publicly disclosed, with proof‑of‑concept code available on GitHub and references on vuldb. The vendor did not respond to notifications, so no official fix has been released yet. Because the vulnerable endpoint can be accessed remotely and the exploit code is already in the public domain, organizations that run this software face a non‑negligible risk of data compromise if no mitigation is applied.