Description

A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v1/plamange/plansImmediate. The manipulation of the argument order/sort leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T04:16:59.040Z",
  "pubdate": "2026-08-24T04:16:59.040Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in the Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to version 300R004C00B300. The security flaw resides within the PlanController.getImmediatePlans function, specifically handling the argument order/sort via the endpoint /xbreport/api/v1/plamange/plansImmediate. This vulnerability allows remote attackers to execute arbitrary SQL commands against the underlying database without requiring authentication. The risk implications are severe, as successful exploitation can lead to unauthorized data access, database modification, or complete system compromise. Public disclosure of the exploit increases the likelihood of active exploitation attempts in the wild. Remediation requires applying vendor-supplied patches or restricting network access to the affected management interface.",
  "technicalDetails": "The vulnerability stems from improper neutralization of user-supplied input within the PlanController.getImmediatePlans function of the Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System. Specifically, the argument associated with order or sort parameters is processed insecurely and concatenated directly into SQL queries executed by the backend database management system. The vulnerable endpoint is exposed at /xbreport/api/v1/plamange/plansImmediate, allowing remote unauthenticated actors to interact with the application over the network.\nThe attack flow proceeds as follows: An attacker crafts a malicious HTTP request targeting the /xbreport/api/v1/plamange/plansImmediate endpoint. Within this request, the attacker manipulates the order or sort argument to include SQL metacharacters and payload syntax. Because the application fails to utilize parameterized queries or proper input sanitization routines for these sorting parameters, the database parser interprets the attacker-supplied input as executable SQL commands rather than literal string data.\nThis flaw grants the remote attacker the ability to inject arbitrary SQL statements, altering the intended logic of the database query. Depending on the database configuration and privileges associated with the application connection, post-exploitation impact may include extracting sensitive database contents, enumerating table structures, bypassing authentication mechanisms, or executing administrative operations on the underlying host database. The exploit is publicly known and can be executed remotely via standard network protocols without prior privileges."
}