CVE-2026-38808
Deferred Deferred - Pending Action
SQL Injection in uzy-ssm-mall e-Commerce Platform

Publication date: 2026-05-27

Last updated on: 2026-05-28

Assigner: MITRE

Description
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-05-28
Generated
2026-06-17
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-38808
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a SQL Injection issue found in uzy-ssm-mall version 1.1.0. It allows a remote attacker to exploit flaws in the ProductMapper.xml and /OrderUtil.java components to access sensitive information from the system.

Impact Analysis

The vulnerability can allow an attacker to remotely obtain sensitive information from the affected system, potentially leading to data breaches or unauthorized access to confidential data.

Compliance Impact

The SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information by exploiting unsafe dynamic SQL concatenation. This exposure of sensitive data can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which mandate the protection of personal and sensitive information from unauthorized access.

Specifically, unauthorized access to sensitive information through this vulnerability could result in breaches of confidentiality and data integrity requirements outlined in these standards, potentially leading to legal and financial consequences for affected organizations.

Detection Guidance

This SQL injection vulnerability can be detected by testing the endpoints that accept the `orderBy` parameter, especially the public endpoint `/mall/product/0/20` which is accessible without authentication.

A common approach is to use automated SQL injection detection tools such as sqlmap to test for injection points by injecting payloads that cause time delays or error messages.

  • Use sqlmap with a time-based blind SQL injection payload targeting the `orderBy` parameter to detect if the database response is delayed, indicating vulnerability.
  • Example command: sqlmap -u "http://target/mall/product/0/20?orderBy=price" --time-sec=10 --technique=T --dbms=mysql
Mitigation Strategies

Immediate mitigation involves preventing unsafe dynamic SQL concatenation by avoiding direct insertion of user input into SQL statements.

  • Implement strict whitelisting for sortable fields to ensure only allowed values are accepted in the `orderBy` parameter.
  • Reject suspicious SQL keywords or special characters in sorting parameters to prevent injection.
  • Review and update the MyBatis XML files to remove usage of `${orderUtil.orderBy}` and replace it with safe parameter binding.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-38808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart