PT-2024-37639 · Litemall · Litemall

Tmac · Published 2024-07-02 · Updated 2024-07-03 · CVE-2024-6452

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions litemall versions up to 1.8.0

Description A critical issue was found in the AdminGoodscontroller.java file, where the manipulation of the goodsId, goodsSn, and name arguments leads to SQL injection. This issue can be exploited remotely.

Recommendations For versions up to 1.8.0, update to a version that fixes this issue to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the AdminGoodscontroller.java file or validating user input for the goodsId, goodsSn, and name arguments to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-6452

Affected Products

Litemall

References · 6

• 🔥 https://github.com/linlinjava/litemall/issues/548 · Exploit
• https://osv.dev/vulnerability/CVE-2024-6452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6452 · Security Note
• https://vuldb.com/?ctiid.270235 · Note
• https://vuldb.com/?id.270235 · Note
• https://vuldb.com/?submit.367635 · Note