SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without p…

SSCMS v7.4.0 contains a critical SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without proper sanitization. Attackers can exploit this flaw by crafting encrypted payloads and submitting them to the /api/stl/actions/dynamic endpoint. The vulnerability allows execution of arbitrary SQL statements, potentially leading to unauthorized database access, data disclosure, authentication bypass, data modification, or complete database compromise. The lack of parameterization makes this a high-severity security issue that could result in total system compromise.