Hitout Car Sale SQL Injection Vulnerability in StoreController

A SQL injection vulnerability has been identified in Hitout Car Sale version 1.0. This vulnerability allows remote attackers to access sensitive information by exploiting the orderBy parameter in the StoreController.java component.

Impact

Exploitation of this vulnerability allows for SQL injection, which could lead to unauthorized data access or manipulation.

Reproduction

The vulnerability can be reproduced by sending a crafted HTTP GET request to the '/store/getList' endpoint. The request must include the 'orderBy' parameter with a payload that exploits the application's SQL query handling, such as using SQL functions to extract database information.