The liyupi yu-picture application is vulnerable to an unauthenticated SQL injection attack that allows remote adversaries to exfiltrate database contents.

This is a SQL injection flaw (CWE-89) located in the PageRequest processing logic within PictureServiceImpl.java, where the user-controlled sortField parameter is passed to the MyBatis-Plus orderBy method without proper validation or parameterization, enabling unauthenticated remote attackers to execute arbitrary SQL queries.

The ability for an unauthenticated attacker to execute arbitrary SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to the unauthorized extraction of sensitive information, including user credentials and administrative passwords, potentially resulting in a full system compromise. With a CVSS score of 7.3, this vulnerability represents a high-risk entry point that should be prioritized for remediation.

Immediate Action: As no official patch is currently available, administrators should implement strict input validation or a whitelist-based filter for the sortField parameter in the affected source files.

Proactive Monitoring: Review application access logs for suspicious POST requests to the /api/picture/list/page/vo and /api/space/list/page/vo endpoints containing unexpected characters or SQL syntax in the sortField parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, specifically targeting time-based blind SQL injection techniques.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the GitHub issue referenced in the research write-up.

Given the high impact of this SQL injection vulnerability and the availability of a public proof-of-concept, users of the liyupi yu-picture component must take immediate action. Since an official vendor patch is currently pending, organizations should apply the aforementioned compensating controls and monitor for malicious activity to mitigate the risk of data exfiltration until a permanent fix is integrated into the codebase.