PT-2026-29726 · Shsuishang · Modulithshop

Xinze · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-5328

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions shsuishang modulithshop versions prior to 829bac71f507e84684c782b9b062b8bf3b5585d6

Description A weakness exists in shsuishang modulithshop. Manipulation of the sidx/sort argument in the listItem function within the ProductIndexServiceImpl.java file of the ProductItemDao Interface component can lead to SQL injection. This attack can be performed remotely, and an exploit is publicly available.

Recommendations Apply patch 42bcb9463425d1be906c3b290cf29885eb5a2324.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-5328

Affected Products

Modulithshop

References · 9

• 🔥 https://github.com/shsuishang/modulithshop/issues/3#issue-4081835434 · Exploit
• https://github.com/shsuishang/modulithshop/commit/42bcb9463425d1be906c3b290cf29885eb5a2324 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5328 · Security Note
• https://github.com/shsuishang/modulithshop/issues/3 · Note
• https://github.com/shsuishang/modulithshop · Note
• https://vuldb.com/vuln/354659/cti · Note
• https://twitter.com/CVEnew/status/2039744363475902571 · Twitter Post
• https://vuldb.com/submit/780789 · Note
• https://vuldb.com/vuln/354659 · Note