CVE-2026-18970 Overview
CVE-2026-18970 is a SQL injection vulnerability in the Rongzhitong Visual Integrated Command and Dispatch Platform through version 20260617. The flaw resides in an unknown function of the file /dm/dispatch/user/findAll, where manipulation of the Name argument enables SQL injection. Attackers can exploit this weakness remotely without authentication or user interaction. A public exploit has been released, increasing the risk of opportunistic attacks. According to VulDB, the vendor was contacted about this disclosure but did not respond.
Critical Impact
Unauthenticated remote attackers can inject SQL statements through the Name parameter of /dm/dispatch/user/findAll, exposing backend database contents and integrity.
Affected Products
- Rongzhitong Visual Integrated Command and Dispatch Platform up to version 20260617
- Endpoint: /dm/dispatch/user/findAll
- Vulnerable parameter: Name
Discovery Timeline
- 2026-08-06 - CVE-2026-18970 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-18970
Vulnerability Analysis
The vulnerability is a SQL injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The affected endpoint /dm/dispatch/user/findAll accepts the Name argument and passes it into a backend SQL query without adequate sanitization or parameterization. Attackers can supply crafted input that alters the query structure. This allows extraction of arbitrary rows, enumeration of database schema, and potential modification of records depending on the database user's privileges. The attack requires no authentication, no user interaction, and can be triggered over the network.
Root Cause
The root cause is improper neutralization of user-controlled input within a database query. The Name argument is concatenated directly into a SQL statement rather than bound as a parameter. This design allows attacker-supplied SQL syntax to be executed by the backend database engine.
Attack Vector
An attacker sends an HTTP request to /dm/dispatch/user/findAll with a malicious Name value containing SQL syntax. Because the exploit has been published, attackers can reuse existing payloads without prior reconnaissance. Successful exploitation may return sensitive user records or trigger unintended queries. The vulnerability manifests entirely in server-side query construction. See the VulDB entry for CVE-2026-18970 and the Feishu Wiki Document for technical details.
Detection Methods for CVE-2026-18970
Indicators of Compromise
- Unusual HTTP requests targeting /dm/dispatch/user/findAll with SQL metacharacters (single quotes, UNION, SELECT, --, ;) in the Name parameter.
- Repeated or automated requests to the endpoint from a single source, consistent with SQL injection scanning tools.
- Application or database error messages triggered by malformed Name values in web server logs.
Detection Strategies
- Inspect web server and application logs for anomalous query strings and payloads against /dm/dispatch/user/findAll.
- Deploy Web Application Firewall (WAF) rules that identify SQL injection signatures in the Name parameter.
- Correlate suspicious HTTP requests with subsequent database queries returning unusually large result sets.
Monitoring Recommendations
- Enable verbose logging on the dispatch platform's web tier to capture full request URIs and parameters.
- Monitor database audit logs for queries against the user table that do not match legitimate application patterns.
- Alert on outbound data transfers from the application server that deviate from historical baselines.
How to Mitigate CVE-2026-18970
Immediate Actions Required
- Restrict network access to /dm/dispatch/user/findAll to trusted internal networks only until a vendor patch is available.
- Deploy WAF signatures that block SQL injection payloads targeting the Name parameter.
- Review application and database logs for signs of prior exploitation attempts against the endpoint.
Patch Information
No vendor patch is available. According to VulDB, the vendor did not respond to the disclosure. Organizations should track vendor communications and apply updates when they become available. Refer to the VulDB Vulnerability #386261 entry for updates.
Workarounds
- Place the affected application behind an authenticated reverse proxy to prevent unauthenticated remote access.
- Implement strict input validation at a reverse proxy or WAF layer that rejects SQL metacharacters in the Name parameter.
- Reduce the privileges of the database account used by the application to limit the impact of successful injection.
# Example WAF rule concept (ModSecurity-style) to block SQLi in the Name parameter
SecRule ARGS:Name "@rx (?i)(union(\s|/\*.*\*/)+select|select\s.+from|--|;|\bor\b\s+\d+=\d+)" \
"id:1026189700,phase:2,deny,status:403,log,msg:'Potential SQLi against /dm/dispatch/user/findAll (CVE-2026-18970)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
