Critical · published February 3, 2026
🚨 A minor oversight in YouDataSum's CPAS Audit Management System allows remote attackers to execute arbitrary SQL commands without breaking a sweat! 🔥 Think of this like a restaurant where customers can slip notes directly to the chef, requesting whatever dish they want without any checks. If left unchecked, that could lead to some seriously bad orders being cooked up! If exploited, an attacker could gain unauthorized access to sensitive data, potentially exposing confidential information and putting the entire system at risk. It’s like handing over the keys to your data vault without even verifying who’s asking!
Think of this like a restaurant where customers can slip notes directly to the chef, requesting whatever dish they want without any checks. If left unchecked, that could lead to some seriously bad orders being cooked up! This vulnerability stems from insufficient input validation in the /cpasList/findArchiveReportByDah endpoint, allowing attackers to inject malicious SQL commands through crafted parameters.
If exploited, an attacker could gain unauthorized access to sensitive data, potentially exposing confidential information and putting the entire system at risk. It’s like handing over the keys to your data vault without even verifying who’s asking! Patch the system to version 4.9.1 or higher to close this vulnerability immediately. Additionally, implement strict input validation and utilize prepared statements to safeguard against such SQL injection flaws. You've got this! By taking these steps, you're on your way to restoring security like a pro! 🛡️