Cnsec

Name of the Vulnerable Software and Affected Versions: Guangdong Baolun Electronics IP Network Broadcasting Service Platform version 2.0 Description: A critical issue was found in the Guangdong Baolun Electronics IP Network Broadcasting Service Platform. It affects an unknown function of the file "/api/v2/maps". The manipulation of the `orderColumn` argument leads to SQL injection. This issue can be exploited remotely. The exploit has been disclosed publicly. Recommendations: For Guangdong Baolun Electronics IP Network Broadcasting Service Platform version 2.0, as a temporary workaround, consider restricting access to the "/api/v2/maps" endpoint to minimize the risk of exploitation. Avoid using the `orderColumn` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.