A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v1/plamange/plansImmediate. The manipulation of the argument order/sort leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

A SQL injection vulnerability has been identified in Shenzhen Gongji Technology's XBROTHER Dynamic Environment Monitoring System, affecting versions up to 300R004C00B300. The vulnerability resides in the PlanController.getImmediatePlans function within the /xbreport/api/v1/plamange/plansImmediate endpoint. Attackers can manipulate the 'order' or 'sort' arguments to perform SQL injection attacks remotely. The exploit has been publicly disclosed, increasing the risk of active exploitation. This affects monitoring infrastructure systems commonly used in data center and facility management environments. No authentication details are specified, suggesting potential unauthenticated access. The public disclosure and remote exploitability make this a high-severity issue requiring prompt patching.