CVE-2026-0843: jjjfood/jjjshop SQLi Vulnerability

CVE-2026-0843 Overview

A SQL injection vulnerability has been identified in jjjfood and jjjshop_food, a PHP-based food ordering system distributed under multiple names including jiujiujia, victor123, and wxw850227. The vulnerability exists in the product category API endpoint and can be exploited remotely by authenticated attackers to manipulate database queries through the latitude parameter.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database contents, or potentially compromise the underlying server through database manipulation techniques.

Affected Products

• jjjfood (versions up to 20260103)
• jjjshop_food (versions up to 20260103)
• Related distributions under jiujiujia/victor123/wxw850227 namespaces

Discovery Timeline

• 2026-01-11 - CVE CVE-2026-0843 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-0843

Vulnerability Analysis

This vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) affecting the product category listing functionality. The vulnerable endpoint /index.php/api/product.category/index fails to properly sanitize the latitude parameter before incorporating it into SQL queries. This allows attackers to inject arbitrary SQL commands that will be executed by the database server.

The attack can be launched remotely over the network, requiring only low-privilege authentication. The exploitation of this vulnerability has been publicly disclosed, and proof-of-concept information is available, increasing the risk of active exploitation in the wild.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the product category API handler. The application directly concatenates user-supplied input from the latitude parameter into SQL statements without proper escaping or the use of prepared statements. This is a fundamental secure coding failure that allows attacker-controlled data to modify the structure and intent of database queries.

Attack Vector

The attack is network-based and targets the /index.php/api/product.category/index endpoint. An authenticated attacker can craft malicious requests containing SQL injection payloads in the latitude parameter. Since the vulnerability affects an API endpoint typically used by mobile applications or frontend JavaScript, the attack surface includes any client application that interacts with this e-commerce platform.

The vulnerability allows for data confidentiality, integrity, and availability impacts. Attackers can potentially read sensitive customer information, modify product or order data, or cause denial of service through resource-intensive queries.

Detection Methods for CVE-2026-0843

Indicators of Compromise

• Unusual or malformed requests to /index.php/api/product.category/index containing SQL syntax in the latitude parameter
• Database error messages appearing in application logs indicating SQL syntax errors or injection attempts
• Abnormal database query patterns such as UNION SELECT, OR 1=1, or time-based injection indicators like SLEEP() or BENCHMARK()
• Unexpected data exfiltration or bulk data access patterns in database audit logs

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in API requests
• Implement application-layer logging for the affected endpoint to capture all parameter values
• Enable database query logging and monitor for anomalous query structures or execution times
• Use intrusion detection systems with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Monitor HTTP access logs for requests to /index.php/api/product.category/index with suspicious latitude values
• Set up alerts for database errors originating from the product category functionality
• Track failed authentication attempts that may precede exploitation attempts
• Review database connection patterns for unusual timing or query volume

How to Mitigate CVE-2026-0843

Immediate Actions Required

• Restrict access to the vulnerable endpoint /index.php/api/product.category/index using network-level controls until patched
• Implement input validation on the latitude parameter to accept only valid numeric coordinate values
• Deploy WAF rules to filter SQL injection payloads targeting this specific endpoint
• Review application logs for evidence of prior exploitation attempts

Patch Information

The vendor was contacted early about this disclosure but did not respond. As of the last update, no official patch has been released. Organizations using jjjfood or jjjshop_food should implement the workarounds below and monitor vendor channels for security updates. For detailed technical information, refer to the VulDB entry for this vulnerability.

Workarounds

• Implement a reverse proxy or WAF rule to sanitize the latitude parameter, allowing only valid decimal number formats
• Modify the application code to use parameterized queries or prepared statements for the vulnerable endpoint
• Consider disabling the product category API endpoint if not critical to operations until a proper fix is available
• Apply principle of least privilege to the database user account used by the application to limit potential damage

# Example nginx configuration to restrict access to vulnerable endpoint
location ~ /index\.php/api/product\.category/index {
    # Allow only internal networks or trusted IPs
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Additional rate limiting
    limit_req zone=api_limit burst=5 nodelay;
}