The vulnerability is a classic SQL injection flaw in the house application, specifically in the /paid/selectall.action endpoint. By manipulating the zuname query argument, an attacker can inject arbitrary SQL code that is executed against the underlying database. This can lead to the disclosure, modification, or deletion of sensitive data stored in the database. The flaw is associated with CWE-74 and CWE-89, indicating both improper input sanitization and general SQL injection weakness, and it can be triggered remotely via HTTP requests.

The affected product is chiuwingyan’s house application. All versions of the application released prior to the commit dea6bcceaebe2b364a5a209747f48ecc2b2dc670 are potentially vulnerable. No specific version numbers are listed, and the vendor has not provided a patch or updated release. Currently the escalation is limited to the web application without a known fixed release.

The CVSS score of 6.9 points to a high risk of data compromise. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack vector is remote and the exploitation of the flaw can be performed over the network, the likelihood of exploitation remains significant. Attacker prerequisites are minimal: access to the Web application’s networked interface. The absence of a vendor response or patch increases the window of opportunity, resulting in an overall moderate to high risk of exploitation.