PT-2026-1772 · Unknown · Rainygao Docsys

Xkalami · Published 2026-01-09 · Updated 2026-01-22 · CVE-2025-15493

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RainyGao DocSys versions up to 2.02.36

Description A flaw exists in RainyGao DocSys that allows for SQL injection. The issue is located in an unknown function within the file src/com/DocSystem/mapping/ReposAuthMapper.xml. Manipulating the searchWord argument can trigger the SQL injection. The attack can be launched remotely. An exploit for this issue has been published. The vendor was notified but did not respond.

Recommendations Versions prior to 2.02.36 should be updated. As a temporary workaround, consider restricting or disabling the functionality related to the searchWord argument in the affected file src/com/DocSystem/mapping/ReposAuthMapper.xml until a patch is available.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2025-15493

Affected Products

Rainygao Docsys

References · 10

• 🔥 https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A52.md#vulnerability-analysis-and-reproduction%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E5%A4%8D%E7%8E%B0 · Exploit
• 🔥 https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A52.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15493 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15493 · Vendor Advisory
• https://t.me/CVEtracker/41854 · Telegram Post
• https://twitter.com/CVEnew/status/2009670026417078456 · Twitter Post
• https://t.me/cveNotify/149573 · Telegram Post
• https://vuldb.com/?submit.725374 · Note
• https://vuldb.com/?id.340271 · Note
• https://vuldb.com/?ctiid.340271 · Note