The product follows a continuous delivery model with rolling releases, meaning no specific version numbers are provided for affected or patched states. The developer was notified of the vulnerability but failed to provide a response or a corrective update. Given the public disclosure of the exploit, organizations utilizing this software should verify their deployment status against the provided commit hash and implement network-level filtering to block exploitation attempts.

Impact

Successful exploitation of this vulnerability allows for unauthorized access to the backend database, potentially leading to the exposure of sensitive data, modification of application content, or full administrative takeover of the database layer. As a remote, unauthenticated vulnerability with a CVSS v3.1 score of 7.3, it poses a significant risk to the integrity and confidentiality of the host environment.

Recommendation

• Review application logs for HTTP requests directed at /paid/selectall.action containing suspicious characters in the zuname parameter, such as single quotes, semicolons, or SQL keywords.
• Implement input validation and parameterized queries for the zuname argument to mitigate SQL injection risk.
• Monitor webserver traffic for incoming POST or GET requests to the identified vulnerable endpoint as part of an incident response baseline.
• If the application is no longer actively maintained, consider isolating the instance from internet-facing networks to prevent external exploitation.