Paramecium

A remote SQL injection exists in the `/paid/selectall.action` endpoint. This occurs when the `zuname` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database.

A path traversal issue exists due to improper processing of the `path` argument within the `src/main/java/com/yeqifu/sys/controller/FileController.java` file. This flaw allows a remote attacker to manipulate file paths to access unauthorized directories or files. Path traversal is a technique used to access files and directories that are stored outside the web root folder.