A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v1/plamange/plansImmediate. The manipulation of the argument order/sort leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

A SQL injection vulnerability has been identified in the Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System, affecting versions up to 300R004C00B300. The vulnerability exists in the PlanController.getImmediatePlans function within the /xbreport/api/v1/plamange/plansImmediate endpoint. Attackers can manipulate the 'order' or 'sort' arguments to perform SQL injection attacks remotely. The exploit has been publicly disclosed, increasing the risk of active exploitation. No authentication barrier details are specified, suggesting potential unauthenticated remote access. The vulnerability poses a significant risk to organizations using this environmental monitoring system. Public disclosure of the exploit raises the urgency for patching or mitigating the affected systems.