A SQL injection vulnerability has been identified in the Rongzhitong Visual Integrated Command and Dispatch Platform up to version 20260617. The flaw exists in an unknown function within the file /dm/dispatch/user/findAll, where manipulation of the 'Name' argument can trigger SQL injection. The attack can be launched remotely without requiring physical access. A public exploit has been published and is available for use. The vendor was notified prior to public disclosure but did not respond. This vulnerability poses a significant risk as it can allow attackers to access, manipulate, or exfiltrate sensitive database contents. The lack of vendor response increases the risk as no official patch or mitigation has been provided.