by Kastro CVE-2025-11629
RainyGao DocSys — RainyGao DocSys getUserList.do getUserList sql injection
Description · from the CVE record
A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected
ProductAffectedFixed inSource
DocSys2.02.0–CNA
DocSys2.02.1–CNA
DocSys2.02.2–CNA
DocSys2.02.3–CNA
DocSys2.02.4–CNA
DocSys2.02.5–CNA
DocSys2.02.6–CNA
DocSys2.02.7–CNA
DocSys2.02.8–CNA
DocSys2.02.9–CNA
DocSys2.02.10–CNA
DocSys2.02.11–CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial