5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8771

CVE-2026-8771: org.linlinjava:litemall-wx-api has an Injection issue

A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java of the component Front-end WeChat API. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8771

CVE-2026-8771:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.linlinjava:litemall-wx-api	maven	<= 0.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic SQL injection flaw in the litemall-wx-api component. The root cause is the lack of input validation on the sort and order parameters for the /wx/goods/list API endpoint. An attacker can provide a malicious SQL payload in the sort parameter. This tainted input is passed from the WxGoodsController.list method down to the LitemallGoodsService.querySelective method. In the service layer, the input is directly concatenated to form an SQL ORDER BY clause, which is then executed by the database. This allows an unauthenticated or low-privileged user to execute arbitrary SQL commands, potentially leading to data exfiltration, including sensitive information like admin password hashes. The provided PoC demonstrates how to extract data using error-based SQL injection. The vulnerability is critical because it exists in a public-facing, front-end API and does not require administrative privileges to exploit.

Vulnerable functions

org.linlinjava.litemall.wx.web.WxGoodsController.list

litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java

This is the controller method for the `/wx/goods/list` endpoint. It takes the `sort` and `order` request parameters and passes them directly to the `goodsService.querySelective` method without any sanitization or validation. An attacker can inject SQL into the `sort` parameter.

org.linlinjava.litemall.db.service.LitemallGoodsService.querySelective

litemall-db/src/main/java/org/linlinjava/litemall/db/service/LitemallGoodsService.java

This service method receives the unsanitized `sort` and `order` parameters from the controller. It concatenates these parameters and uses them to set the `orderByClause` on a MyBatis `Example` object. This clause is then used in a raw, non-parameterized fashion in the corresponding XML mapper (`<if test=\"orderByClause != null\"> order by ${orderByClause} </if>`), which allows for SQL injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.