This vulnerability in chiuwingyan house up to commit dea6bcceaebe2b364a5a209747f48ecc2b2dc670 allows remote attackers to perform SQL injection by manipulating the zuname argument in the /paid/selectall.action file. The vulnerability is remotely exploitable without privileges or user interaction. Due to the product's continuous delivery model, specific affected or fixed versions are not identified. The vendor has not provided any response or patch information. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized SQL commands execution on the backend database, potentially allowing attackers to access or manipulate data. The impact is rated medium due to limited confidentiality, integrity, and availability impacts. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing application-layer protections such as input validation and web application firewalls to mitigate SQL injection risks until an official fix is released.