Liujianview Gymxmjpa SQL Injection Vulnerability in Menber Controller

A critical SQL injection vulnerability has been identified in Liujianview Gymxmjpa version 1.0. The issue arises in the MenberDaoInpl function within the MenberController.java file. The vulnerability is triggered by unfiltered input in the hyname parameter, allowing for blind SQL injection. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for SQL injection, which could lead to unauthorized data access or manipulation.

Reproduction

The vulnerability can be reproduced by sending a request to the menber/query endpoint with a crafted hyname parameter that includes SQL injection payloads. This can be done by appending SQL injection techniques, such as tautology-based or union-based payloads, to the hyname parameter. The injection can be verified by checking the application's response for signs of SQL injection, such as database errors or unexpected data.