CVE-2026-105158
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A SQL injection vulnerability was detected in RainyGao DocSys up to 2.02.85 in the BaseController.createDBForMysql function of BaseController.java (Database Management component). Manipulation of the url argument allows SQL injection. The exploit is publicly available and the attack can be executed remotely.
Risk Assessment
The vulnerability allows a remote attacker to execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The project has not responded, so a patch may not be available.
Recommendation
Immediately restrict access to DocSys from untrusted networks, apply the patch as soon as it becomes available, and validate/sanitize arguments passed to createDBForMysql.
Other vulnerabilities in RainyGao DocSys
See all- CVE-2026-105157Medium
A path traversal vulnerability was detected in RainyGao DocSys up to 2.02.85 in the DocController.doGetTmp function of /Doc/doGetTmpFile.do (Document Controller component). Manipulation of the path/fileName arguments leads to path traversal. Remote exploitation is possible and the exploit is publicly disclosed.
- CVE-2025-11631Medium
A path traversal vulnerability in RainyGao DocSys up to 2.02.36 in /Doc/deleteDoc.do allows manipulation of the path argument. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-11630Medium
A path traversal vulnerability in RainyGao DocSys up to 2.02.36 in the updateRealDoc function of /Doc/uploadDoc.do allows manipulation of the path argument. The attack can be initiated remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS