PT-2026-1772 · Unknown · Rainygao Docsys

Xkalami · Publicado 2026-01-09 · Atualizado 2026-01-22 · CVE-2025-15493

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RainyGao DocSys versions up to 2.02.36

Description A flaw exists in RainyGao DocSys that allows for SQL injection. The issue is located in an unknown function within the file src/com/DocSystem/mapping/ReposAuthMapper.xml. Manipulating the searchWord argument can trigger the SQL injection. The attack can be launched remotely. An exploit for this issue has been published. The vendor was notified but did not respond.

Recommendations Versions prior to 2.02.36 should be updated. As a temporary workaround, consider restricting or disabling the functionality related to the searchWord argument in the affected file src/com/DocSystem/mapping/ReposAuthMapper.xml until a patch is available.

Exploit

Correção

SQL injection

Special Elements Injection

Enumeração de Fraquezas

CWE-89

CWE-74

Identificadores relacionados

CVE-2025-15493

Produtos afetados

Rainygao Docsys

Referências · 10

• 🔥 https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A52.md#vulnerability-analysis-and-reproduction%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E5%A4%8D%E7%8E%B0 · Exploit
• 🔥 https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A52.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15493 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-15493 · Aviso do Fabricante
• https://t.me/CVEtracker/41854 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2009670026417078456 · Publicação no Twitter
• https://t.me/cveNotify/149573 · Publicação no Telegram
• https://vuldb.com/?submit.725374 · Nota
• https://vuldb.com/?id.340271 · Nota
• https://vuldb.com/?ctiid.340271 · Nota