zj1983 zz SQL Injection Vulnerability in UserLoginJson Endpoint

A critical SQL injection vulnerability has been identified in zj1983 zz versions through 2024-8. The issue resides in the GetDBUser function within ZorgAction.java. The vulnerability allows for remote exploitation by manipulating the user_id parameter, which is directly concatenated into the SQL query without proper sanitization.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to the UserLoginJson endpoint with a crafted user_id parameter that includes SQL injection payloads. The SQL injection can be verified using a tool like sqlmap, which can automate the process of detecting and exploiting SQL injection vulnerabilities.