The vulnerability allows an attacker to manipulate the ChannelName parameter in the XCamera.ashx endpoint to inject arbitrary SQL commands. When the attack succeeds, the attacker can read, modify or delete data stored in the underlying database, potentially compromising confidentiality, integrity, or availability of system information. The flaw is a classic SQL injection described by CWE‑74 and CWE‑89.

Fujian Smart Integrated Management Platform System, versions up to 7.5, includes the XCamera.ashx handler under /Module/CRXT/Controller/. The affected function is undocumented, but any installation of the platform prior to 7.5 runs with the vulnerable component.

The CVSS score is 6.9, indicating a moderate severity. EPSS shows a very low exploitation probability of less than 1%. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to send a specially crafted HTTP request to the vulnerable endpoint, which is reachable from the internet or internal network, and has no known mitigations in place. Consequently, the risk is considered moderate but manageable with prompt remediation.