CVE-2025-22214 Scanner

Landray EIS is an enterprise information system designed to streamline workflows, document management, and communication processes within organizations. It is widely adopted by corporations to enhance operational efficiency, manage records, and facilitate inter-departmental collaboration. The platform offers a centralized repository for documents, enabling users to access, share, and control information seamlessly. Its user-friendly interface and integrated features make it a popular choice for businesses seeking robust document management solutions.

CVE-2025-22214 is a critical SQL Injection vulnerability that arises from insufficient input sanitization in Landray EIS. This flaw allows attackers to manipulate backend SQL queries by injecting malicious code through user-supplied input fields. The vulnerability occurs when the application fails to properly validate or escape data before incorporating it into database queries, enabling unauthorized database interactions.

Specifically, the vulnerability exists in the document management module's search or parameter handling endpoint. Attackers can exploit this by crafting malicious input in parameters such as 'id', 'keyword', or similar fields, which are directly concatenated into SQL statements without proper sanitization. This allows them to execute arbitrary SQL commands, bypass authentication, or extract sensitive data from the database.

If exploited, CVE-2025-22214 can lead to severe consequences, including unauthorized access to confidential documents, user credentials, and other sensitive enterprise data. Attackers may also modify or delete critical information, compromising data integrity and availability. The high CVSS score of 9.0 underscores the potential for significant business disruption, financial loss, and reputational damage.