PT-2026-2039 · Unknown+1 · Jjjshop Food+1

Badkitty + 5 · Publicado 2026-01-11 · Atualizado 2026-01-11 · CVE-2026-0843

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jjjfood and jjjshop food versions up to 20260103

Description A flaw exists in jjjfood and jjjshop food that allows for SQL injection. The issue is located in unknown code within the file '/index.php/api/product.category/index'. Manipulation of the latitude argument can trigger the injection. The attack can be performed remotely. The exploit has been publicly disclosed. There is evidence of increased targeting of jiujiujia and other vendors related to this issue.

Recommendations Versions up to 20260103 should be updated. As a temporary workaround, restrict or disable access to the /index.php/api/product.category/index endpoint. Avoid using the latitude parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Special Elements Injection

Enumeração de Fraquezas

CWE-89

CWE-74

Identificadores relacionados

CVE-2026-0843

Produtos afetados

Jjjfood

Jjjshop Food

Referências · 10

• 🔥 http://101.200.76.102:38765/qwertyuiop/qwsdfvbnm/1/vuldb/JJJshop/EnglishVers%E4%B8%89%E5%8B%BE%E7%82%B9%E9%A4%90%E7%B3%BB%E7%BB%9FPHP%E7%89%88%E5%AD%98%E5%9C%A8product.category.indexSQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.pdf · Exploit
• https://vuldb.com/?submit.731001 · Nota
• https://twitter.com/CVEnew/status/2010284687663513883 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2010284202319642745 · Publicação no Twitter
• https://twitter.com/vuldb/status/2010328616438239618 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0843 · Nota de Segurança
• https://t.me/CVEtracker/41958 · Publicação no Telegram
• https://t.me/cveNotify/148369 · Publicação no Telegram
• https://vuldb.com/?ctiid.340443 · Nota
• https://vuldb.com/?id.340443 · Nota