Executive brief
litemall is an open-source e-commerce platform. A security flaw in its database management component allows an attacker with administrative privileges to inject malicious commands during database backup or restoration processes. This could lead to unauthorized file creation on the server or potential full system takeover.
Technical details
An argument injection vulnerability exists in the backup() and load() functions within litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java. The application uses Runtime.exec(String) to execute mysqldump and mysql commands, concatenating the 'db' and 'password' parameters directly into the command string. Because Runtime.exec(String) tokens are delimited by whitespace, an attacker can inject additional flags (such as --result-file) by including spaces in these parameters. This can be leveraged to write arbitrary files to the filesystem, which may lead to Remote Code Execution (RCE) via cron job manipulation or web shell placement. The vulnerability requires high privileges (PR:H) to access the database settings. As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- linlinjava litemall up to 1.8.0
Timeline
- 2026-04-23: disclosed: Vulnerability reported and PoC created by researcher
- 2026-05-18: advisory: CVE-2026-8773 published via NVD/VulDB