PT-2024-31979 · Linlinjava · Litemall

X0Blank · Published 2024-09-19 · Updated 2024-09-25 · CVE-2024-46382

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions linlinjava litemall version 1.8.0

Description A SQL injection issue allows a remote attacker to obtain sensitive information via the goodsId, goodsSn, and name parameters in AdminGoodscontroller.java. This could potentially lead to unauthenticated remote code execution. It is recommended to review code for similar vulnerabilities and audit logs for signs of exploitation.

Recommendations For linlinjava litemall version 1.8.0, consider disabling the AdminGoodscontroller.java function temporarily until a patch is available. Restrict access to the vulnerable parameters goodsId, goodsSn, and name to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-46382

Affected Products

Litemall

References · 7

• 🔥 https://github.com/linlinjava/litemall/issues/552 · Exploit
• https://osv.dev/vulnerability/CVE-2024-46382 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46382 · Security Note
• https://twitter.com/oktsec/status/1836791861454803121 · Twitter Post
• https://twitter.com/CVEnew/status/1836759431603982779 · Twitter Post
• https://t.me/cvenotify/96001 · Telegram Post
• https://t.me/cvedetector/6051 · Telegram Post