Baison Channel Middleware SQL Injection Vulnerability in Product 2.0.1

A critical SQL injection vulnerability has been identified in Baison Channel Middleware Product version 2.0.1. The issue arises in the file '/e3api/api/main/ToJsonByControlName', where the 'data' argument can be manipulated to execute arbitrary SQL commands. This vulnerability can be exploited remotely, allowing attackers to retrieve database information using various injection techniques, such as boolean-based, time-based, and union-based injections.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can execute malicious SQL queries that could manipulate the database or retrieve sensitive information.