648540858 wvp-GB28181-pro SQL Injection Vulnerability in Stream Proxy Query Component

A critical SQL injection vulnerability has been identified in 648540858 wvp-GB28181-pro versions through 2.7.4. The issue resides in the Stream Proxy Query Handler, specifically within the selectAll function of StreamProxyProvider.java. The vulnerability allows authenticated attackers to execute arbitrary SQL commands by exploiting the /api/proxy/list endpoint, where user input is improperly sanitized before being included in SQL statements. This flaw could lead to unauthorized access to sensitive database information.

Impact

Exploitation of this vulnerability allows for arbitrary SQL command execution, potentially leading to unauthorized data access or manipulation within the database.