Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
DescriptionCVE.org
A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via the goodsId, goodsSn, and name parameters in AdminOrderController.java.
AnalysisAI
SQL injection in linlinjava litemall 1.8.0 allows unauthenticated remote attackers to extract sensitive data from the backend database by injecting malicious payloads into the goodsId, goodsSn, and name parameters handled by AdminOrderController.java. Publicly available exploit code exists, though EPSS rates exploitation probability low at 0.12% (30th percentile) and the issue is not listed in CISA KEV.
Technical ContextAI
litemall is an open-source Java-based e-commerce mall platform built by linlinjava that provides a small mall application stack (Spring Boot backend, admin console, WeChat mini-program, and Vue.js frontend). The vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled inputs are concatenated into SQL queries without parameterization or sufficient sanitization. The CPE cpe:2.3:a:linlinjava:litemall:1.8.0 confirms the affected component is the application itself at version 1.8.0, and the flaw resides specifically in the AdminOrderController class responsible for order management queries that accept the goodsId, goodsSn, and name request parameters.
RemediationAI
No vendor-released patch identified at time of analysis from the provided data; users should monitor the upstream linlinjava/litemall GitHub repository for a fixed release beyond 1.8.0 and apply it once available. As compensating controls, restrict network access to the /admin API surface (where AdminOrderController is exposed) to trusted management IPs via firewall or reverse-proxy ACLs, place the admin console behind a VPN or authenticated gateway, and enforce strong authentication on admin routes so the endpoint cannot be reached anonymously even if the application defaults allow it. As a code-level workaround for operators maintaining their own build, replace the dynamic SQL or MyBatis ${} expressions for goodsId, goodsSn, and name in AdminOrderController with parameterized #{} bindings and add allow-list input validation; the trade-off is the need to rebuild and redeploy from source, but this directly eliminates the injection path.
Share
External POC / Exploit Code
Leaving vuln.today