Unauthenticated database query manipulation via username input

SQL injection in dingfanzu CMS allows remote attackers to alter database queries through the username parameter in /ajax/checkin.php. The handler fails to neutralize SQL syntax in attacker-controlled username input before the database processes the resulting query. No authentication or user interaction is required, and the public artifact establishes proof-of-concept exploitation rather than documented in-the-wild use.