liujianview gymxmjpa SQL Injection Vulnerability in LoosController

A critical SQL injection vulnerability has been identified in liujianview gymxmjpa version 1.0. The issue arises in the LoosController.java file, specifically within the LoosDaoImpl function. The vulnerability allows for remote exploitation by manipulating the loosName parameter, which is not properly sanitized before being used in SQL queries.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

The vulnerability can be reproduced by sending a request to the /loos/query endpoint with a crafted loosName parameter. The injection can be verified by using SQL payloads that, for example, extract database information or manipulate the query results.