Description

A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-06T22:16:53.430Z",
  "pubdate": "2026-08-06T22:16:53.430Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the house product developed by chiuwingyan, specifically impacting the file path /paid/selectall.action up to commit dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This security flaw stems from the improper neutralization of user-supplied input within the zuname argument. Exploitation of this vulnerability allows remote attackers to manipulate database queries, potentially leading to unauthorized data exposure, data modification, or complete database compromise. The product utilizes continuous delivery with rolling releases, meaning formal version numbers are absent, and no updated releases are currently available to address the flaw. The vendor was contacted early regarding the disclosure but failed to provide any response. Given that public exploits exist and the attack can be executed remotely without prior authentication or privileged access, the risk implications are severe. Organizations utilizing affected instances face high exposure to malicious database manipulation.",
  "technicalDetails": "The vulnerability resides in the backend handling of HTTP requests directed at the /paid/selectall.action endpoint within the house application. Specifically, the root cause is inadequate input sanitization and parameterized query implementation for the zuname parameter. When a remote attacker submits specially crafted SQL payloads via the zuname argument, the application unsafely concatenates or interprets the input directly within dynamic SQL database queries. This breakdown in the separation of data and command execution allows the injected SQL syntax to alter the intended logic of the database query structure. The attack flow initiates when an unauthenticated or remotely positioned adversary transmits an HTTP request containing the malicious payload targeting the vulnerable action endpoint. Upon receipt, the application processes the zuname parameter and forwards the unsanitized input to the underlying database management system. The database executes the resulting malicious query, granting the attacker the ability to extract sensitive backend data, bypass authentication controls, or execute administrative operations depending on database permissions. Network exposure for this vector is external, as the vulnerable endpoint /paid/selectall.action is accessible remotely over the network. The affected codebase spans all revisions up to commit dea6bcceaebe2b364a5a209747f48ecc2b2dc670. Because the software employs a rolling release model without discrete version numbering, identifying exact patched versions is not possible through traditional version tracking. Post-exploitation impact includes unauthorized data exfiltration, integrity compromise of stored records, and potential escalation of privileges within the database layer."
}