The flaw resides in the getLikeMovieList function of HomeController.java in the weimai-wetapp project. The function accepts a 'cat' argument that is directly concatenated into an SQL query without sanitization or parameterization, which is a classic SQL injection vulnerability (CWE-74, CWE-89). Attackers can inject arbitrary SQL statements when calling this endpoint, potentially allowing them to read, modify, or delete database information and thereby compromising the confidentiality, integrity, and availability of the application's data.

The affected product is xierongwkhd's weimai-wetapp. All releases up to the commit 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2 contain the issue. Because the project uses a rolling release model, specific version numbers for fixed releases are not available; any deployment that has not incorporated a newer commit containing the fix remains vulnerable.

The vulnerability carries a CVSS score of 5.1, which places it in the moderate severity range. Its EPSS score is reported as less than 1 % and it is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating a low probability of widespread exploitation. Nevertheless, the publicly available exploit can be triggered remotely by manipulating the 'cat' parameter; no authentication requirement is mentioned, so the threat remains actionable for exposed deployments.