This vulnerability in GongShengyue OnlineBooks up to commit dfc5eacc08d3b0396c266049548618f6fb9587ea involves SQL injection via the 'column' parameter in the listSplit interface of src/cn/ylcto/book/servlet/BooksServlet.java. The flaw allows remote attackers to inject SQL commands due to improper input handling. The product's rolling release model means no explicit version numbers for affected or patched releases are provided. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The CVSS 4.0 score of 5.3 indicates a medium severity with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

No official patch or remediation information is provided. Since the product uses a rolling release system, users should monitor vendor updates closely and apply any forthcoming fixes promptly. In the absence of a confirmed patch, consider implementing input validation or web application firewall rules to mitigate SQL injection risks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.