There is a sql injection vulnerability in the crmeb_java system /api/front/store/list

[Tyaoo]

[Suggested description] There is a SQL Injection vulnerability in crmeb_java <=1.3.4, caused by the param sortKey which is in ${} format and isn't strictly filtered.

[Vulnerability Type] SQLi

[Vendor of Product] https://github.com/crmeb/crmeb_java

[Affected Product Code Base] <=1.3.4

[Affected Component] /api/front/store/list

[Attack Type] Remote

[Vulnerability details]

[Impact Code execution] true [Cause of vulnerability] The interface /api/front/store/list call the function getNearList function getNearList will be called when inputing both latitude and longitude parameters. The latitude and longitude parameters are used in ${} format and it will be joined to the sql string directly.