There is a SQL Injection in the backend

[0xzer0]

The problem exists in the "WeixinSystemProjectController.java",You can see that there is no filtering in the code:

The code use "${" to splice the parameters directly in the "WeixinSystemProject.xml".

And this leads to a SQL injection.

[XYUU]

竟然还能sql注入。