YouDataSum CPAS Audit Management System SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the YouDataSum CPAS Audit Management System, affecting versions through 4.9. The issue arises in the 'findArchiveReportByDah' endpoint, where inadequate input validation allows remote, unauthenticated attackers to execute arbitrary SQL commands. Exploitation of this vulnerability could result in unauthorized access to data.

Impact

Exploitation of this vulnerability could lead to unauthorized data access.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/cpasList/findArchiveReportByDah' endpoint. The 'dah' parameter should be crafted to include SQL injection payloads, such as a condition that manipulates the SQL query execution, for example by using 'AND (SELECT(SLEEP(5)))' to demonstrate the injection.