# CVE-2026-8772: linlinjava litemall SQL injection in multiple Admin Controllers

Source: https://junglewise.ai/threats/cve-2026-8772-linlinjava-litemall-sql-injection-in-multiple-admin-controllers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-8772 · Severity: medium · CVSS 4.7 · Published 2026-05-18

linlinjava litemall, an open-source e-commerce platform, contains a security vulnerability in its administrative management interface. An attacker with administrative access can perform unauthorized database queries, potentially leading to the theft of sensitive customer data, administrative credentials, and full database contents. This issue affects multiple management modules including user, order, and product storage lists.

Technologies: [Linlinjava Litemall](https://junglewise.ai/threats/technologies/litemall). Vendors: [Linlinjava](https://junglewise.ai/threats/vendors/linlinjava).

## Quick answers

**Is CVE-2026-8772 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8772 being exploited in the wild.

**How severe is CVE-2026-8772?** Medium severity, with a CVSS score of 4.7, published 18 May 2026.

**Which products and versions are affected?** Linlinjava Litemall up to 1.8.0.

**Is there a fix for CVE-2026-8772?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8772 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8772?** Check whether you run Linlinjava Litemall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in linlinjava litemall up to version 1.8.0 due to improper neutralization of special elements in the 'sort' and 'order' HTTP parameters. The root cause is the use of string interpolation (${orderByClause}) instead of parameterized constants in MyBatis Mapper XML files across 37 different mappers. This allows an authenticated attacker with administrative privileges to perform boolean-based blind, error-based (via extractvalue), and time-based SQL injection. Affected endpoints include /admin/aftersale/list, /admin/user/list, /admin/topic/list, and several others. While the vendor was notified, no official patch has been released; developers are advised to implement a whitelist for sortable columns and avoid direct concatenation in the setOrderByClause method.

## Affected products

- linlinjava litemall up to 1.8.0

## Timeline

- 2026-04-23: disclosed: Vulnerability reported by researcher berna
- 2026-05-18: advisory: CVE-2026-8772 published

## References

- [https://gist.github.com/A1AAAAAAAAAA1/bc875f5be52b44b2e557c5312e355d47](https://gist.github.com/A1AAAAAAAAAA1/bc875f5be52b44b2e557c5312e355d47)
- [https://vuldb.com/submit/811468](https://vuldb.com/submit/811468)
- [https://vuldb.com/vuln/364397](https://vuldb.com/vuln/364397)
- [https://vuldb.com/vuln/364397/cti](https://vuldb.com/vuln/364397/cti)

## Related threats

- [litemall stored XSS in product detail via v-html](https://junglewise.ai/threats/cve-2026-90570-litemall-stored-xss-in-product-detail-via-v-html)
- [linlinjava litemall stored XSS in topic content](https://junglewise.ai/threats/cve-2026-90569-linlinjava-litemall-stored-xss-in-topic-content)
- [linlinjava litemall argument injection in DbUtil.java](https://junglewise.ai/threats/cve-2026-8773-linlinjava-litemall-argument-injection-in-dbutil-java)
- [linlinjava litemall SQL injection in WxGoodsController](https://junglewise.ai/threats/cve-2026-8771-linlinjava-litemall-sql-injection-in-wxgoodscontroller)