Description
A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStatus/queryResources of the component Endpoint. Performing a manipulation of the argument areaId results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-16
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a SQL injection flaw located in the Tiandy Easy7 Integrated Management Platform 7.17.0 endpoint /rest/devStatus/queryResources. An attacker can manipulate the "areaId" parameter to inject arbitrary SQL statements against the backend database. The flaw is classified as CWE‑74 and CWE‑89, and if exploited it could allow unauthorized database queries or commands, potentially compromising confidentiality, integrity, or availability of the system’s data.

Affected Systems

The affected system is the Tiandy Easy7 Integrated Management Platform version 7.17.0. No additional product versions are listed in the provided information; the vulnerability is tied specifically to the unknown function of the /rest/devStatus/queryResources endpoint in this version.

Risk and Exploitability

The CVSS base score is 6.9, indicating a medium level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be initiated remotely by sending a crafted HTTP request to the vulnerable endpoint, and a public exploit has been released. Attackers can remotely access the target over the network to exploit the injection, bypass authentication or obtain sensitive data from the database.

Generated by OpenCVE AI on March 17, 2026 at 02:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply an official patch or upgrade to a fixed version of Tiandy Easy7 Integrated Management Platform as soon as it becomes available.
  • If a patch is not yet released, access to the /rest/devStatus/queryResources endpoint should be restricted to trusted IP ranges or internal networks only.
  • Enable detailed logging on the affected endpoint and monitor logs for suspicious activity, such as unusual SQL queries or repeated failed requests.
  • If the endpoint is not required for business operations, consider disabling or removing the /rest/devStatus/queryResources function to eliminate the attack surface.

Generated by OpenCVE AI on March 17, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 17 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 17 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Tiandy
Tiandy easy7 Integrated Management Platform
Vendors & Products Tiandy
Tiandy easy7 Integrated Management Platform

Tue, 17 Mar 2026 00:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStatus/queryResources of the component Endpoint. Performing a manipulation of the argument areaId results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Tiandy Easy7 Integrated Management Platform Endpoint queryResources sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tiandy Easy7 Integrated Management Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-17T13:34:00.118Z

Reserved: 2026-03-16T16:31:29.018Z

Link: CVE-2026-4287

cve-icon Vulnrichment

Updated: 2026-03-17T13:33:55.777Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-17T00:16:19.493

Modified: 2026-03-17T14:20:01.670

Link: CVE-2026-4287

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-24T10:49:41Z

Weaknesses