Onlinebooks
Monthly
SQL injection in GongShengyue OnlineBooks allows authenticated remote attackers to manipulate database queries through the `column` parameter of the listSplit interface in BooksServlet.java. The vulnerability enables partial data extraction, modification, and potential availability impact against the backend database. A public proof-of-concept exploit has been published on GitHub, raising near-term exploitation probability for any internet-exposed deployments.
SQL injection in GongShengyue OnlineBooks allows authenticated remote attackers to manipulate database queries through the `column` parameter of the listSplit interface in BooksServlet.java. The vulnerability enables partial data extraction, modification, and potential availability impact against the backend database. A public proof-of-concept exploit has been published on GitHub, raising near-term exploitation probability for any internet-exposed deployments.