Description

A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file src/cn/ylcto/book/servlet/BooksServlet.java of the component listSplit Interface. The manipulation of the argument column results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T11:17:00.050Z",
  "pubdate": "2026-09-13T11:17:00.050Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the GongShengyue OnlineBooks application, specifically within the listSplit interface of the BooksServlet component.\nThe vulnerability allows remote attackers to inject arbitrary SQL commands via the 'column' parameter, leading to unauthorized database access, data exfiltration, or modification.\nAffected systems include versions up to commit dfc5eacc08d3b0396c266049548618f6fb9587ea.\nGiven the nature of SQL injection, this vulnerability poses a severe risk to data integrity and confidentiality.\nThe exploit is currently public, significantly increasing the probability of active exploitation by malicious actors.\nSuccessful exploitation requires no prior authentication, allowing unprivileged remote attackers to interact directly with the backend database.",
  "technicalDetails": "The vulnerability resides in the src/cn/ylcto/book/servlet/BooksServlet.java file within the listSplit interface of the GongShengyue OnlineBooks application.\nThe root cause is the insecure handling of user-supplied input provided through the 'column' argument. The application fails to properly sanitize or parameterize this input before incorporating it into a database query string.\nThe attack flow initiates when a remote attacker sends a crafted HTTP request to the listSplit endpoint. By supplying a malicious SQL payload within the 'column' parameter, the attacker can manipulate the structure of the backend SQL query.\nBecause the application does not utilize prepared statements or parameterized queries for this specific function, the database engine executes the attacker's injected SQL commands alongside the legitimate query logic.\nThis allows for blind, error-based, or union-based SQL injection techniques. An attacker can systematically extract sensitive information from the underlying database, such as administrator credentials, user data, or configuration details.\nBeyond data exfiltration, the vulnerability may enable an attacker to perform unauthorized data manipulation, such as modifying table contents, deleting records, or, depending on database permissions and configuration, executing administrative commands or accessing the underlying file system.\nThe exploit is performed remotely and does not require pre-existing authentication, significantly expanding the attack surface.\nThis flaw is present in all versions up to commit dfc5eacc08d3b0396c266049548618f6fb9587ea. As the product follows a rolling release model, users are advised to verify their current version hash against the vulnerable commit and monitor for official updates or patches addressing this specific code path in BooksServlet.java."
}