This vulnerability in chiuwingyan house allows remote attackers to perform SQL injection by manipulating the 'zuname' parameter in the /paid/selectall.action endpoint. The exact affected versions are unknown due to the product's continuous delivery model and lack of vendor response. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. Public exploit information is available, but no confirmed active exploitation is reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with limited confidentiality, integrity, and availability impact. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates and consider implementing application-layer protections such as input validation or web application firewalls to mitigate SQL injection risks until a patch is released.