CVE-2026-9551

HIGH

Das Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell sql injection

Title source: cna
STIX 2.1

Description

A vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0. This affects the function xp_cmdshell of the file ParkingRecord/ExportParkingRecords of the component API Endpoint. The manipulation of the argument Value leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-365610 | Das Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell sql injection
https://vuldb.com/vuln/365610
Signature, Permissions Required signature permissions-required
VDB-365610 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/365610/cti
Third Party Advisory third-party-advisory
Submit #815456 | Shenzhen DAS INTELLITECH Co., Ltd. Parking Management System 6.2.0 SQL Injection
https://vuldb.com/submit/815456

Scores

CVSS v3 7.3
EPSS 0.0032
EPSS Percentile 23.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
Das/Parking Management System 停车场管理系统 6.2.0
Published May 26, 2026
Tracked Since May 26, 2026