Description

A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-14T01:18:57.440Z",
  "pubdate": "2026-08-14T01:18:57.440Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in the Raisecom Communication Command and Dispatch Management Platform up to version 7.6.5. This security defect resides within the /app/users/getpwd.php script and stems from the insecure handling of the sip parameter. An unauthenticated remote attacker can exploit this vulnerability to manipulate backend database queries, potentially leading to unauthorized data access, information disclosure, or complete compromise of the underlying database management system. The attack vector is fully remote, requiring network connectivity to the targeted management platform. A public exploit is currently available in the wild, significantly elevating the risk of active exploitation. The vendor was notified of this vulnerability prior to public disclosure but failed to provide a response or an official remediation patch. Organizations utilizing the affected Raisecom platform face elevated risk and must implement immediate compensating controls or restrict network access to the vulnerable interface to prevent potential exploitation.",
  "technicalDetails": "The vulnerability is classified as a SQL injection (SQLi) flaw affecting the Raisecom Communication Command and Dispatch Management Platform in versions up to 7.6.5. The root cause of the vulnerability lies in the inadequate sanitization, validation, and parameterization of user-supplied input passed via the sip parameter within the vulnerable file /app/users/getpwd.php. Because the application directly concatenates or unsafely evaluates the tainted sip parameter into dynamic SQL statements executed against the backend database, an attacker can inject malicious SQL syntax.\nThe attack flow begins with a remote threat actor sending a specially crafted HTTP request targeting the /app/users/getpwd.php endpoint. By supplying malicious SQL payloads within the sip argument, the attacker breaks the intended logic of the database query. The database interpreter evaluates the injected commands as legitimate SQL instructions, allowing the execution of arbitrary database queries. Depending on the configuration of the database user account utilized by the application, post-exploitation impact may include extracting sensitive application data such as user credentials, enumeration of database schemas, or interaction with the underlying operating system if advanced database features are enabled.\nNetwork exposure for this vulnerability is remote, meaning any entity with network access to the Raisecom Communication Command and Dispatch Management Platform can initiate the attack vector. Authentication requirements are absent or bypassed, as the vulnerable script /app/users/getpwd.php handles password recovery functionality and is typically accessible without prior session establishment. Given that a functional exploit is publicly available, attackers require minimal technical sophistication to execute automated exploitation routines against exposed instances. The absence of vendor-supplied patches necessitates robust defensive configurations to neutralize the threat."
}