CVE-2026-105158
Received Received - Intake

SQL Injection in RainyGao DocSys

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulDB

Description
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-105158
EUVD
EUVD-2026-92109

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rainygao docsys to 2.02.85 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in RainyGao DocSys up to version 2.02.85. It exists in the BaseController.createDBForMysql function where the url parameter is directly concatenated into raw SQL queries without proper sanitization. This allows attackers to inject malicious SQL commands by manipulating the url parameter.

Detection Guidance

To detect this SQL injection vulnerability in DocSys, check if the application exposes the POST /Manage/resetDatabase.do endpoint. Send a test request with a malicious url parameter containing SQL payloads like 'url=http://example.com/db; DROP TABLE users;--' and observe if the database responds unexpectedly or errors occur.

Impact Analysis

An attacker could exploit this to execute arbitrary SQL commands on the database. This may lead to unauthorized data access, modification, or deletion. The attack can be performed remotely without authentication, potentially compromising sensitive information stored in the system.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA by enabling unauthorized access to or destruction of personal or health data. Organizations using this software may face compliance penalties, legal consequences, and reputational damage due to data breaches.

Mitigation Strategies

Immediately disable the /Manage/resetDatabase.do endpoint if not required. Apply input validation to sanitize the url parameter, using allowlists for expected URL formats. Replace direct SQL query concatenation with parameterized queries or an ORM. Ensure proper authentication and authorization checks are enforced before database operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105158. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart