CVE Alert: CVE-2025-11313 – Tipray 厦门天锐科技股份有限公司 – Data Leakage Prevention System 天锐数据泄露防护系统

Risk verdict

High risk: remote SQL injection in the DLP system with a publicly available exploit; exploitation is network-accessible and does not require authentication.

Why this matters

Compromise could enable data leakage or manipulation within the DLP platform, potentially exposing sensitive information or altering enforcement rules. If an attacker gains foothold, lateral movement to connected data stores or management consoles is a real concern.

Most likely attack path

Attackers can exploit via the sort parameter in the findRolePage.do endpoint over the network, without user interaction. No authentication is required, and the impact per metric is low to moderate on confidentiality, integrity, and availability, but the overall exposure is significant because the vector is remote and PoC code exists.

Who is most exposed

Typically deployed as on-premises or private-cloud appliances with web management interfaces; organisations that expose these dashboards to internal networks or DMZs are most at risk. Public-facing instances or weak network segmentation amplify the danger.

Detection ideas

• Anomalous requests to /findRolePage.do with unusual sort values.
• SQL error messages or database error codes appearing in responses or logs.
• Repeated, rapid requests from a single host to the affected endpoint.
• Unusual authentication-less access attempts to the DLP UI.
• SIEM/waf alerts mapping to known PoC patterns or exploit indicators.

Mitigation and prioritisation

• Apply vendor patch or upgrade to fixed version as a first step.
• If patching is delayed, implement compensating controls: block/fence vulnerable endpoint behind WAF, and restrict access to trusted networks.
• Enforce input validation and parameterised queries in the application layer; remove or neutralise the sort parameter vulnerability.
• Short-term disablement of the vulnerable function or endpoint, if feasible, and review roles/permissions in the DLP system.
• Plan and execute change management with test in a staging environment; confirm logs and alerts cover the exploit indicators.