Attack Chain

1. Attacker identifies the vulnerable API endpoint /ParkingRecord/ExportParkingRecords.
2. Attacker crafts a malicious HTTP request targeting the API endpoint.
3. The request includes a modified Value argument designed to inject SQL commands into the application’s database query.
4. The application processes the request without proper sanitization of the Value argument.
5. The injected SQL commands are executed against the database.
6. The attacker retrieves sensitive data from the database or modifies existing data.
7. The attacker uses xp_cmdshell to execute arbitrary operating system commands.

Impact

Successful exploitation of CVE-2026-9551 allows an attacker to execute arbitrary SQL commands on the affected system. This can lead to unauthorized access to sensitive data, modification of data, or complete system compromise through operating system command execution via xp_cmdshell. The absence of vendor response exacerbates the risk, potentially leading to widespread exploitation if left unpatched.

Recommendation

• Deploy the Sigma rule Detect CVE-2026-9551 Exploitation Attempt via SQL Injection to identify exploitation attempts (see below).
• Monitor web server logs for suspicious requests to /ParkingRecord/ExportParkingRecords containing SQL injection payloads (see Sigma rule and webserver logs).
• Apply input validation and sanitization to the Value argument in the ParkingRecord/ExportParkingRecords API endpoint.
• Disable or restrict the use of xp_cmdshell if not required to prevent command execution.