PT-2026-24843 · Xierongwkhd · Weimai-Wetapp

Zast.Ai · Publicado 2026-03-11 · Atualizado 2026-06-03 · CVE-2026-3956

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xierongwkhd weimai-wetapp versions prior to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2

Description A security issue exists in xierongwkhd weimai-wetapp. The getAdmins function within the file source-code/src/main/java/com/moke/wp/wx weimai/controller/admin/Admin AdminUserController.java is susceptible to SQL injection. Manipulating the keyword argument can trigger this issue. Remote exploitation is possible. The exploit is publicly available. The software utilizes a rolling release model, meaning specific version details for affected or updated releases are not provided. The project maintainers were notified of the problem but have not yet responded.

Recommendations Versions prior to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2: As a temporary workaround, consider restricting access to the getAdmins function until a patch is available.

Exploit

Correção

SQL injection

Special Elements Injection

Enumeração de Fraquezas

CWE-89

CWE-74

Identificadores relacionados

CVE-2026-3956

Produtos afetados

Weimai-Wetapp

Referências · 10

• 🔥 https://github.com/xierongwkhd/weimai-wetapp/issues/48 · Exploit
• https://twitter.com/zast_ai/status/2061964554515698055 · Publicação no Twitter
• https://vuldb.com/?submit.767884 · Nota
• https://twitter.com/geng_zast/status/2061971513793028517 · Publicação no Twitter
• https://t.me/CVEtracker/47181 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-3956 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031867639857893493 · Publicação no Twitter
• https://vuldb.com/?id.350386 · Nota
• https://vuldb.com/?ctiid.350386 · Nota
• https://github.com/xierongwkhd/weimai-wetapp · Nota