SQL Injection Vulnerability in chiuwingyan house

A SQL injection vulnerability has been identified in the house application developed by chiuwingyan, affecting all commits up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. The flaw resides within the /paid/selectall.action endpoint, where the zuname argument fails to properly sanitize user-supplied input before being included in a database query. This vulnerability can be exploited remotely by an unauthenticated attacker to manipulate backend database operations.

The product follows a continuous delivery model with rolling releases, meaning no specific version numbers are provided for affected or patched states. The developer was notified of the vulnerability but failed to provide a response or a corrective update. Given the public disclosure of the exploit, organizations utilizing this software should verify their deployment status against the provided commit hash and implement network-level filtering to block exploitation attempts.

Impact

Successful exploitation of this vulnerability allows for unauthorized access to the backend database, potentially leading to the exposure of sensitive data, modification of application content, or full administrative takeover of the database layer. As a remote, unauthenticated vulnerability with a CVSS v3.1 score of 7.3, it poses a significant risk to the integrity and confidentiality of the host environment.

Recommendation

• Review application logs for HTTP requests directed at /paid/selectall.action containing suspicious characters in the zuname parameter, such as single quotes, semicolons, or SQL keywords.
• Implement input validation and parameterized queries for the zuname argument to mitigate SQL injection risk.
• Monitor webserver traffic for incoming POST or GET requests to the identified vulnerable endpoint as part of an incident response baseline.
• If the application is no longer actively maintained, consider isolating the instance from internet-facing networks to prevent external exploitation.