CVE-2026-8772

Vulnerability

Litemall up to version 1.8.0 contains a SQL injection vulnerability in multiple admin controller list endpoints. The flaw exists because the sort and order HTTP parameters are directly concatenated into MyBatis Mapper XML files using ${orderByClause} (string interpolation) instead of parameterized queries. The affected endpoints include /admin/aftersale/list, /admin/comment/list, /admin/feedback/list, /admin/topic/list, /admin/ad/list, /admin/coupon/list, /admin/user/list, and /admin/storage/list [1]. No authentication is explicitly mentioned as required to reach these endpoints.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted HTTP GET requests to any of the affected admin list endpoints. The sort parameter can contain SQL injection payloads, such as IF(1=1,id,name), which are executed by the MySQL database backend. The proof of concept demonstrates boolean-based blind SQL injection: changing the condition from true to false alters the sort order, confirming successful injection [1]. The attack is network-based and does not require user interaction.

Impact

A successful SQL injection attack could allow an attacker to extract sensitive data from the underlying database, including user information, order details, and other confidential records. The attacker may also be able to modify or delete data, depending on the database user privileges. The impact is information disclosure and potential data integrity compromise.

Mitigation

As of the published date (2026-05-18), the vendor was contacted but did not respond [1]. No official patch or fixed version has been released. Users should apply input validation and use parameterized queries as a workaround, or consider upgrading to a forked or alternative version that addresses this issue. The vulnerability is not listed in the KEV catalog at this time.