CVE-2024-6452: Linlinjava Litemall SQL Injection Flaw

CVE-2024-6452 Overview

CVE-2024-6452 is a SQL injection vulnerability in linlinjava litemall through version 1.8.0. The flaw resides in the AdminGoodscontroller.java file, where the goodsId, goodsSn, and name request parameters are passed unsanitized into database queries [CWE-89]. Attackers can exploit the issue remotely with low-privileged access, and the exploit has been publicly disclosed. Litemall is an open-source e-commerce platform built on Spring Boot, commonly used for training and small-scale deployments.

Critical Impact
Authenticated remote attackers can inject arbitrary SQL statements through the admin goods interface, exposing product data and potentially the underlying database.

Affected Products

linlinjava litemall versions up to and including 1.8.0
Deployments exposing the AdminGoodscontroller.java endpoints
Systems using the affected goodsId, goodsSn, or name parameters in admin queries

Discovery Timeline

2024-07-02 - CVE-2024-6452 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6452

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the admin goods management functionality of litemall. When an authenticated administrator queries products, the application accepts the goodsId, goodsSn, and name parameters from HTTP requests and incorporates them into database queries without proper sanitization or parameterization.

Because the injection point resides in an admin controller, an attacker needs valid low-privileged credentials to reach the vulnerable code path. Once authenticated, the attacker can manipulate the query to read arbitrary tables, extract user records, or enumerate database schema information. The attack vector is network-based and requires no user interaction beyond the attacker's own session.

The vulnerability has been publicly disclosed and referenced under VulDB identifier VDB-270235. No official patch has been published in the vendor's repository at the time of NVD listing.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The AdminGoodscontroller.java handler concatenates or interpolates user-supplied strings into MyBatis or JDBC query fragments instead of binding them as prepared statement parameters. Any single quote, comment marker, or SQL keyword supplied via the affected parameters becomes part of the executed query.

Attack Vector

The attacker authenticates to the litemall admin interface, then issues a crafted request to the admin goods listing endpoint. Injecting a payload such as a boolean-based or UNION-based expression into goodsId, goodsSn, or name causes the backend to return manipulated result sets. Blind and time-based techniques are also viable when response content is limited. Refer to the GitHub Issue Report and VulDB #270235 for public technical detail.

Detection Methods for CVE-2024-6452

Indicators of Compromise

Admin-scoped HTTP requests to litemall goods endpoints containing SQL metacharacters such as ', --, UNION, or SLEEP( in the goodsId, goodsSn, or name parameters
Database logs showing malformed or unusually long queries originating from the litemall application user
Repeated 500-series responses or unusual query latency from the admin goods listing endpoint

Detection Strategies

Enable web application firewall rules that flag SQL injection patterns on admin API paths
Correlate admin session activity with database error events to identify probing behavior
Alert on admin accounts issuing high volumes of goods search requests within short time windows

Monitoring Recommendations

Forward litemall application and database logs to a centralized SIEM for query-level analysis
Baseline normal administrator query patterns and alert on deviations
Monitor outbound connections from the litemall host for signs of data exfiltration following suspected injection attempts

How to Mitigate CVE-2024-6452

Immediate Actions Required

Restrict access to the litemall admin interface to trusted networks or VPN users only
Rotate administrator credentials and enforce strong authentication on admin accounts
Audit the AdminGoodscontroller.java code and refactor affected queries to use parameterized statements

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Track the upstream GitHub Issue Report for remediation status. Operators running litemall 1.8.0 or earlier should apply the workarounds below until a fixed release is available.

Workarounds

Replace string concatenation in MyBatis mappers with #{} parameter bindings instead of ${} substitution for the affected fields
Deploy a web application firewall rule set to block SQL injection payloads targeting the admin goods endpoints
Apply input validation that constrains goodsId to numeric values and goodsSn/name to expected character sets
Limit administrator database privileges to the minimum required, reducing the impact of a successful injection

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on litemall admin goods endpoint
SecRule REQUEST_URI "@beginsWith /admin/goods" \
    "chain,id:1006452,phase:2,deny,status:403,msg:'Potential SQLi on litemall admin goods (CVE-2024-6452)'"
    SecRule ARGS:goodsId|ARGS:goodsSn|ARGS:name "@rx (?i)(union\s+select|sleep\(|--|';|/\*)" \
        "t:none,t:urlDecodeUni"