CVE-2026-105158 RainyGao CVE debrief

Who should care

Defenders of RainyGao DocSys installations should assess exposure and prioritize verification of affected systems, focusing on system configurations and database management practices to prevent SQL injection attacks. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

The SQL injection vulnerability in RainyGao DocSys allows for remote exploitation and has a publicly available exploit, requiring defenders to assess exposure and prioritize verification of affected systems.

• Verify system configurations and database management practices to prevent SQL injection attacks
• Implement compensating controls to detect and prevent SQL injection attacks
• Monitor for suspicious activity and exception tracking to detect potential exploitation

Technical summary

The vulnerability allows for remote exploitation and has a publicly available exploit. The project vendor has been informed but has not responded yet. The SQL injection vulnerability in RainyGao DocSys allows for remote exploitation and has a publicly available exploit, requiring defenders to assess exposure and prioritize verification of affected systems. The vulnerability was detected in RainyGao DocSys up to 2.02.85, specifically in the BaseController.createDBForMysql function of the BaseController.java file. The manipulation of the argument url results in sql injection.

Defensive priority

Assess exposure and prioritize verification of affected systems

Recommended defensive actions

• Assess exposure of RainyGao DocSys installations
• Verify system configurations and database management practices
• Implement compensating controls to detect and prevent SQL injection attacks
• Monitor for suspicious activity and exception tracking
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. The SQL injection vulnerability allows for remote exploitation and has a publicly available

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.