A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStat…

A SQL injection vulnerability has been discovered in Tiandy Easy7 Integrated Management Platform version 7.17.0. The vulnerability affects the /rest/devStatus/queryResources endpoint where manipulation of the areaId parameter leads to SQL injection. The attack can be performed remotely and public exploits are available. The vendor was contacted but did not respond to the disclosure.