CVE-2026-38808
SQL Injection in uzy-ssm-mall e-Commerce Platform
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a SQL Injection issue found in uzy-ssm-mall version 1.1.0. It allows a remote attacker to exploit flaws in the ProductMapper.xml and /OrderUtil.java components to access sensitive information from the system.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to remotely obtain sensitive information from the affected system, potentially leading to data breaches or unauthorized access to confidential data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information by exploiting unsafe dynamic SQL concatenation. This exposure of sensitive data can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which mandate the protection of personal and sensitive information from unauthorized access.
Specifically, unauthorized access to sensitive information through this vulnerability could result in breaches of confidentiality and data integrity requirements outlined in these standards, potentially leading to legal and financial consequences for affected organizations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This SQL injection vulnerability can be detected by testing the endpoints that accept the `orderBy` parameter, especially the public endpoint `/mall/product/0/20` which is accessible without authentication.
A common approach is to use automated SQL injection detection tools such as sqlmap to test for injection points by injecting payloads that cause time delays or error messages.
- Use sqlmap with a time-based blind SQL injection payload targeting the `orderBy` parameter to detect if the database response is delayed, indicating vulnerability.
- Example command: sqlmap -u "http://target/mall/product/0/20?orderBy=price" --time-sec=10 --technique=T --dbms=mysql
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves preventing unsafe dynamic SQL concatenation by avoiding direct insertion of user input into SQL statements.
- Implement strict whitelisting for sortable fields to ensure only allowed values are accepted in the `orderBy` parameter.
- Reject suspicious SQL keywords or special characters in sorting parameters to prevent injection.
- Review and update the MyBatis XML files to remove usage of `${orderUtil.orderBy}` and replace it with safe parameter binding.