Executive brief
GongShengyue OnlineBooks is a book management application with a web interface. A SQL injection vulnerability in the book listing feature allows remote attackers to manipulate database queries and extract sensitive data without authentication. This could expose all book records, user information, and other data stored in the backend database.
Technical details
The vulnerability is a classic SQL injection flaw in the BooksServlet's listSplit interface (/pages/back/books/BooksServlet/listSplit). The "column" parameter is taken directly from user input and concatenated into SQL queries without sanitization or parameterized statements, specifically in the BooksDAOImpl.java getAllCount method. An unauthenticated remote attacker can exploit this via HTTP GET requests by injecting SQL syntax (e.g., UNION queries, time-based boolean injection) to modify WHERE clauses or extract arbitrary database content. The attack vector is network-based with no authentication required. Public exploits are available.
Affected products
- GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea
Timeline
- 2026-09-13: disclosed: Vulnerability disclosed publicly with exploit proof-of-concept