Executive brief
linlinjava litemall, an open-source e-commerce platform, contains a security vulnerability in its administrative management interface. An attacker with administrative access can perform unauthorized database queries, potentially leading to the theft of sensitive customer data, administrative credentials, and full database contents. This issue affects multiple management modules including user, order, and product storage lists.
Technical details
A SQL injection vulnerability exists in linlinjava litemall up to version 1.8.0 due to improper neutralization of special elements in the 'sort' and 'order' HTTP parameters. The root cause is the use of string interpolation (${orderByClause}) instead of parameterized constants in MyBatis Mapper XML files across 37 different mappers. This allows an authenticated attacker with administrative privileges to perform boolean-based blind, error-based (via extractvalue), and time-based SQL injection. Affected endpoints include /admin/aftersale/list, /admin/user/list, /admin/topic/list, and several others. While the vendor was notified, no official patch has been released; developers are advised to implement a whitelist for sortable columns and avoid direct concatenation in the setOrderByClause method.
Affected products
- linlinjava litemall up to 1.8.0
Timeline
- 2026-04-23: disclosed: Vulnerability reported by researcher berna
- 2026-05-18: advisory: CVE-2026-8772 published