Guchengwuyue Yshopmall SQL Injection Vulnerability in Job Controller

A SQL injection vulnerability has been identified in Guchengwuyue Yshopmall versions through 1.9.1. The issue arises in the JobController's getJobs function, where the sort parameter is manipulated, leading to unauthorized SQL command execution. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a GET request to the /api/jobs endpoint with a crafted sort parameter. The request must include a valid Authorization header with a Bearer token. This vulnerability can be tested using tools like Postman or through a simple script that automates the request.