PT-2024-20358 · Linlinjava · Litemall

Published 2024-02-27 · Updated 2025-09-15 · CVE-2024-24323

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions linlinjava litemall version 1.8.0

Description The issue allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, orderStatusArray parameters of the AdminOrdercontroller.java component. This is a SQL injection vulnerability, which means an attacker can inject malicious SQL code to manipulate the database and extract sensitive data.

Recommendations For linlinjava litemall version 1.8.0, consider restricting access to the vulnerable AdminOrdercontroller.java component until a patch is available. As a temporary workaround, avoid using the nickname, consignee, orderSN, orderStatusArray parameters in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-24323

Affected Products

Litemall

References · 6

• 🔥 https://github.com/lousix/exp/blob/main/CVE-2024-24323/CVE-2024-24323.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-24323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24323 · Security Note
• https://twitter.com/CVEnew/status/1762521693292236932 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1762560434987569332 · Twitter Post
• https://t.me/cveNotify/135495 · Telegram Post