There is a sql injection vulnerability in the crmeb_java system /api/front/store/list

[Tyaoo]

[Suggested description]
There is a SQL Injection vulnerability in crmeb_java <=1.3.4, caused by the param sortKey which is in ${} format and isn't strictly filtered.

[Vulnerability Type]
SQLi

[Vendor of Product]
https://github.com/crmeb/crmeb_java

[Affected Product Code Base]
<=1.3.4

[Affected Component]
/api/front/store/list

[Attack Type]
Remote

[Vulnerability details]

[Impact Code execution]
true
[Cause of vulnerability]
The interface /api/front/store/list call the function getNearList

function getNearList will be called when inputing both latitude and longitude parameters.

The latitude and longitude parameters are used in ${} format and it will be joined to the sql string directly.