A remotely exploitable SQL injection vulnerability has been discovered in Tiandy Easy7 Integrated Management Platform. The flaw exists within the unknown function of the file /rest/preSetTemplate/getRecByTemplateId, where manipulating the ID parameter allows an attacker to inject arbitrary SQL. This can lead to unauthorized reading or alteration of the underlying database, potentially exposing sensitive configuration or operational data. The official description notes that the exploit has been publicly disclosed and may be used by threat actors.

The vulnerability affects Tiandy Easy7 Integrated Management Platform versions up to and including 7.17.0. The affected component is the REST endpoint /rest/preSetTemplate/getRecByTemplateId. No additional version information beyond the upper bound 7.17.0 is available from the CVE data.

The CVSS score of 6.9 indicates a medium severity risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, where an attacker sends crafted HTTP requests to the vulnerable endpoint from outside the network. Because the exploit was publicly disclosed and may be used, the risk of exploitation remains significant without remediation.