CVE-2026-8771

Vulnerability

Description

A critical SQL injection vulnerability exists in linlinjava litemall up to version 1.8.0, specifically in the front-end WeChat API. The flaw resides in the WxGoodsController.java file, where the sort parameter from the HTTP request is passed directly into the querySelective method of LitemallGoodsService.java. In that service, the sort and order parameters are concatenated into an orderByClause string without any sanitization or whitelist validation. This string is then interpolated directly into the SQL query via ${orderByClause} in the MyBatis mapper XML, leading to SQL injection [1].

Exploitation

The vulnerable endpoint is /wx/goods/list, which is part of the public-facing WeChat API. Unlike previously reported SQL injection issues in litemall (CVE-2024-24323, CVE-2024-46382) that required admin authentication, this vulnerability is accessible to any regular user or even unauthenticated visitors, depending on the Shiro configuration [1]. The sort parameter is attacker-controlled and is not filtered, allowing the injection of arbitrary SQL commands. Public proof-of-concept exploits have been released, demonstrating extraction of sensitive data such as admin password hashes from the database [1].

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL queries against the underlying MySQL database. This can lead to complete compromise of the application's data, including user credentials, personal information, and administrative secrets. The CVSS score is 8.8 (Critical) due to the low complexity, no required privileges, and high impact on confidentiality, integrity, and availability [1].

Mitigation

The vendor was contacted but did not respond, and no official patch has been released as of the publication date. Users of litemall up to version 1.8.0 are advised to apply input validation and parameterized queries to the affected sort and order parameters, or to restrict access to the /wx/goods/list endpoint until a fix is available. Given the public availability of exploit code, this vulnerability is likely to be actively targeted [1].