CVE-2025-15493 is a medium severity SQL injection (CVSS 6.3) in RainyGao DocSys up to 2.02.36. The searchWord value reaches a query defined in ReposAuthMapper.xml, and the record says an exploit is public. The vendor did not respond and no fixed version is confirmed.
What's affected
The record lists RainyGao DocSys up to version 2.02.36, a document management system. The affected element is the mapper file src/com/DocSystem/mapping/ReposAuthMapper.xml, and the input is the searchWord argument. The attack is network based and, per the CVSS vector, needs a low privilege account.
The record says an exploit has been published and that the vendor was contacted early but did not respond. I found no fixed release in the record or in the public report I fetched.
A mapper XML file points to MyBatis, a Java library where queries are written in XML. In MyBatis, a value written with a dollar sign placeholder is pasted into the SQL text, while a value written with a hash sign placeholder is bound as a parameter. That difference is the usual cause of this bug class.
How to check if you're exposed
Find your version in the application's About page or the deployed jar and compare it with 2.02.36:
find / -name "*DocSystem*" 2>/dev/null | head
If you maintain the code, search the mapper file for the vulnerable pattern:
grep -n 'searchWord' src/com/DocSystem/mapping/ReposAuthMapper.xml
Look at how the value is written in the query. Then review access logs for search requests with quote characters or SQL keywords in the search term, and check the database logs for syntax errors raised by the application account.
What to do now
- Confirm whether DocSys 2.02.36 or earlier runs in your environment, and who can reach it.
- Limit access to the application to your network or a VPN, and remove accounts that are not needed since the attack needs a login.
- If you maintain a copy, switch the vulnerable placeholder in the mapper to a bound parameter and rebuild.
- Review search logs and the database for odd queries, and rotate the database password.
- Check the project page for a fixed release before the next upgrade cycle.
Why it matters
The record lists CWE-89, SQL Injection, and CWE-74, Injection. Search features are common culprits because their input is free text and is often joined into a LIKE clause. When the application builds that clause by string joining, the query itself can be rewritten by the person typing.
The score is medium because it requires an authenticated account (6.3), but document systems often hold contracts and internal records, so the data is worth more than the score implies. It is not in CISA's Known Exploited Vulnerabilities catalog per the record.
Quick check
Why does a mapper XML file matter here?
DocSys appears to use MyBatis style mappers. How a value is written in the query decides whether it is pasted into the SQL or bound as a parameter.
Do I need an account to exploit it?
The CVSS vector lists low privileges required, so the described attack needs a login.
Sources
Last reviewed: 19 October 2026.
