EUVD-2026-54203
GHSA-6p53-hx3w-pgfc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires no auth or interaction; SQL injection yields partial data read/write, no availability impact described.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in chiuwingyan's 'house' web application exposes the /paid/selectall.action endpoint to remote unauthenticated attackers who can manipulate the zuname parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation, and the E:P supplemental metric confirms a public proof-of-concept has been disclosed via VulDB. No patch exists and the vendor did not respond to responsible disclosure, leaving deployments permanently unmitigated absent operator-side controls.
Technical ContextAI
The vulnerability resides in the /paid/selectall.action endpoint of 'house,' a web application authored by chiuwingyan and tracked at commit dea6bcceaebe2b364a5a209747f48ecc2b2dc670. CWE-74 (Injection) identifies the root cause as insufficient neutralization of user-controlled input before it is incorporated into a downstream interpreter - in this case SQL. The zuname request parameter is concatenated directly into a SQL query without parameterization, escaping, or input validation, allowing an attacker to alter query structure. The .action suffix suggests a Java-based MVC framework (e.g., Struts or Spring MVC) routing the request, though no CPE string is available to confirm the technology stack precisely.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the vendor did not respond to disclosure contact. Operators running this application should immediately restrict network access to the /paid/selectall.action endpoint via firewall rules or reverse-proxy ACLs, limiting access to trusted IP ranges only - this directly addresses the AV:N attack vector and eliminates remote exploitation without requiring code changes. If a web application firewall is in place, deploy a SQL injection signature rule targeting the zuname parameter as a compensating control, noting that WAF rules can be bypassed by sophisticated attackers and are not a substitute for code-level fixes. If the source code is accessible, apply parameterized queries or prepared statements to the affected endpoint, replacing any direct string concatenation of zuname into SQL. Reference the disclosure at https://vuldb.com/vuln/386532 for reproduction details to verify remediation effectiveness. Forking and patching the repository is the only durable fix given vendor non-response.
Share
External POC / Exploit Code
Leaving vuln.today