A flaw was discovered in Tiandy Easy7 Integrated Management Platform version 7.17.0. The GetDBDataEx.jsp component fails to sanitize the strTBName argument before including it in a database query. This oversight allows an attacker to inject arbitrary SQL, which can lead to unauthorized reading, alteration or deletion of data stored by the platform. The vulnerability is exploitable from a remote location through crafted HTTP requests and is already publicly documented.

The attack targets Tiandy Easy7 Integrated Management Platform, specifically the 7.17.0 release. The vulnerability description does not list other affected versions, but the code involved is 'unknown', implying that any release containing GetDBDataEx.jsp could potentially be at risk.

The CVSS score of 6.9 indicates medium severity. Although no EPSS value is supplied, the exploit is publicly available and the vendor has not yet responded with a fix, raising the practical risk. The vulnerability is not listed in CISA's KEV catalog, but the public availability of the exploit means a timely response is critical.