PT-2026-2039 · Unknown+1 · Jjjshop Food+1

Badkitty + 5 · Published 2026-01-11 · Updated 2026-01-11 · CVE-2026-0843

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jjjfood and jjjshop food versions up to 20260103

Description A flaw exists in jjjfood and jjjshop food that allows for SQL injection. The issue is located in unknown code within the file '/index.php/api/product.category/index'. Manipulation of the latitude argument can trigger the injection. The attack can be performed remotely. The exploit has been publicly disclosed. There is evidence of increased targeting of jiujiujia and other vendors related to this issue.

Recommendations Versions up to 20260103 should be updated. As a temporary workaround, restrict or disable access to the /index.php/api/product.category/index endpoint. Avoid using the latitude parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-0843

Affected Products

Jjjfood

Jjjshop Food

References · 10

• 🔥 http://101.200.76.102:38765/qwertyuiop/qwsdfvbnm/1/vuldb/JJJshop/EnglishVers%E4%B8%89%E5%8B%BE%E7%82%B9%E9%A4%90%E7%B3%BB%E7%BB%9FPHP%E7%89%88%E5%AD%98%E5%9C%A8product.category.indexSQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0843 · Security Note
• https://vuldb.com/?submit.731001 · Note
• https://twitter.com/CVEnew/status/2010284687663513883 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2010284202319642745 · Twitter Post
• https://twitter.com/vuldb/status/2010328616438239618 · Twitter Post
• https://t.me/CVEtracker/41958 · Telegram Post
• https://t.me/cveNotify/148369 · Telegram Post
• https://vuldb.com/?ctiid.340443 · Note
• https://vuldb.com/?id.340443 · Note