The vulnerability resides in the GetDBData.jsp endpoint of Tiandy Easy7 CMS Windows 7.17.0, where the strTBName parameter is improperly sanitized. An attacker can exploit this flaw by crafting a malicious payload that is injected directly into SQL statements, leading to unauthorized data read, modification, or deletion. The flaw is remote; an attacker only needs to send the exploit over HTTP to the vulnerable web service. Exploitation code is publicly available, indicating that the threat is real and actionable.

Tiandy Easy7 CMS for Windows, specifically version 7.17.0. No other versions are mentioned in the CNA data. The CPE notation confirms that the issue affects the Windows deployment of the 7.17.0 release.

The CVSS score of 6.9 classifies this as a medium severity vulnerability, reflecting potential for significant confidentiality impact. EPSS is reported as less than 1%, suggesting a low likelihood of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. However, the confirmed remote nature of the attack and the existence of published exploit code mean that the risk to exposed systems remains significant. There is no indication that elevated privileges on the host are required; the primary risk manifests at the database layer.