Microcommunity
Monthly
SQL injection in java110 MicroCommunity (through version 2.0) allows remote attackers to inject arbitrary SQL through the fallBackSql argument of the fallBack API endpoint implemented in BusinessApi.java / QueryServiceSMOImpl.fallBack. Publicly available exploit code exists (published as a Gitee issue), and because CVSS 4.0 carries PR:N, exploitation is claimed to need no authentication - though an independent assessment notes the endpoint may in practice sit behind application authentication, which would narrow real-world exposure. The project has not responded to the report, so no vendor fix is identified, and the CVE is not listed in CISA KEV, meaning confirmed active exploitation has not been established.
SQL injection in java110 MicroCommunity (through version 2.0) allows remote attackers to inject arbitrary SQL through the fallBackSql argument of the fallBack API endpoint implemented in BusinessApi.java / QueryServiceSMOImpl.fallBack. Publicly available exploit code exists (published as a Gitee issue), and because CVSS 4.0 carries PR:N, exploitation is claimed to need no authentication - though an independent assessment notes the endpoint may in practice sit behind application authentication, which would narrow real-world exposure. The project has not responded to the report, so no vendor fix is identified, and the CVE is not listed in CISA KEV, meaning confirmed active exploitation has not been established.