The vulnerability is located in the function PageRequest of PictureServiceImpl.java, where the sortField argument is concatenated directly into a SQL query using MyBatis-Plus. This omission of proper input validation allows an attacker to inject arbitrary SQL statements. An attacker can thus read, modify, or delete data in the database, compromising the confidentiality and integrity of the stored information. The flaw provides a classic command injection vector that is exploitable remotely without any authentication, leading to significant risk of data exposure or corruption.

The affected product is liyupi's yu-picture, an open‑source web application without explicit versioning. All releases up to the commit a053632c41340152bf75b66b3c543d129123d8ec are vulnerable, and the project has not released a fixed version yet. Users running any current iteration before the fix are at risk.

The CVSS v3.1 score is 6.9, indicating moderate severity. The EPSS score is less than 1%, suggesting low immediate exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw remotely via crafted HTTP requests that supply a malicious sortField value. Once the injection succeeds, the attacker can execute arbitrary SQL, potentially compromising the entire application database.