CVE-2026-3287: Youlai-mall SQL Injection Vulnerability

CVE-2026-3287 Overview

A SQL injection vulnerability has been discovered in youlaitech youlai-mall version 2.0.0. This security flaw affects the listPagedSpuForApp function within the file mall-pms/pms-boot/src/main/java/com/youlai/mall/pms/controller/app/SpuController.java, which is part of the App-side Product Pagination Endpoint. By manipulating the sortField or sort arguments, an attacker can inject malicious SQL commands. This vulnerability can be exploited remotely over the network, and exploit details have been publicly released. The vendor was contacted about this disclosure but did not respond.

Critical Impact

Remote SQL injection enabling unauthorized database access, data manipulation, and potential data exfiltration through the product pagination endpoint.

Affected Products

• youlai-mall version 2.0.0
• App-side Product Pagination Endpoint (SpuController.java)
• youlai youlai-mall e-commerce platform

Discovery Timeline

• 2026-02-27 - CVE-2026-3287 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-3287

Vulnerability Analysis

This SQL injection vulnerability exists in the listPagedSpuForApp function responsible for handling paginated product queries in the youlai-mall e-commerce application. The vulnerable code resides in the SpuController.java file within the Product Management System (PMS) module. When the application processes user-supplied input for the sortField and sort parameters, it fails to properly sanitize these values before incorporating them into SQL queries. This allows attackers to inject arbitrary SQL statements that are then executed against the backend database with the privileges of the application's database user.

The vulnerability is classified under CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The attack requires low privileges and can be executed remotely without user interaction, making it accessible to authenticated users of the application.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the product pagination functionality. The sortField and sort parameters are directly concatenated into SQL queries without proper sanitization or the use of prepared statements. This allows user-controlled input to alter the structure of SQL queries, enabling injection attacks. The application fails to implement secure coding practices such as input whitelisting for sort fields or utilizing ORM frameworks that automatically escape dynamic query parameters.

Attack Vector

The attack vector for CVE-2026-3287 is network-based, targeting the App-side Product Pagination Endpoint. An authenticated attacker can craft malicious HTTP requests to the pagination endpoint, manipulating the sortField or sort query parameters to include SQL injection payloads. The attack flow involves sending specially crafted sorting parameters that break out of the intended query context and append malicious SQL commands. Since the vulnerability exists in a publicly accessible API endpoint, exploitation can occur remotely with minimal complexity. The exploit has been publicly released, increasing the risk of active exploitation in the wild.

The vulnerability can be exploited by sending malicious values in the sort-related parameters of the pagination request. For example, an attacker could inject SQL commands through the sortField parameter to extract sensitive database information, modify records, or perform other unauthorized database operations. Technical details are available in the Feishu Document and VulDB entry #348016.

Detection Methods for CVE-2026-3287

Indicators of Compromise

• Unusual SQL syntax or special characters (e.g., ', --, ;, UNION, SELECT) appearing in web server access logs for the product pagination endpoint
• Database query logs showing unexpected queries or error messages related to the PMS module
• Abnormal database access patterns from the application server, particularly targeting product-related tables
• Web application firewall alerts triggered by SQL injection attack patterns in pagination requests

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block SQL injection attempts targeting sort parameters
• Implement application-level logging to capture all requests to the /app/spu pagination endpoints and analyze for malicious patterns
• Configure database activity monitoring to alert on unusual query patterns or unauthorized data access attempts
• Use intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Enable verbose logging on the youlai-mall application to capture detailed request parameters
• Monitor database server CPU and I/O for anomalies that may indicate SQL injection-based data extraction
• Establish baseline metrics for pagination endpoint usage and alert on significant deviations
• Review web server logs regularly for requests containing SQL keywords in query parameters

How to Mitigate CVE-2026-3287

Immediate Actions Required

• Restrict access to the App-side Product Pagination Endpoint to trusted users or networks until patching is possible
• Implement input validation on the sortField and sort parameters to allow only predefined, whitelisted values
• Deploy a web application firewall (WAF) with rules specifically targeting SQL injection in sorting parameters
• Review and audit database user permissions to ensure the application uses least-privilege database accounts

Patch Information

As of the last update on 2026-03-02, the vendor (youlaitech) has not released an official patch for this vulnerability. The vendor was contacted regarding this disclosure but did not respond. Organizations using youlai-mall 2.0.0 should implement the workarounds listed below and monitor for any vendor updates. Additional technical information and vulnerability details can be found at VulDB.

Workarounds

• Implement server-side input validation to whitelist acceptable values for sortField (e.g., price, name, created_at) and sort (e.g., ASC, DESC) parameters
• Modify the SpuController.java code to use parameterized queries or prepared statements for dynamic sorting
• Deploy a reverse proxy or WAF in front of the application to filter malicious requests before they reach the vulnerable endpoint
• Consider temporarily disabling the sorting functionality in the pagination endpoint until a proper fix is implemented

# Example WAF rule to block SQL injection attempts in sort parameters
# For ModSecurity-based WAF
SecRule ARGS:sortField "@rx (?i)(union|select|insert|update|delete|drop|--|\"|\'|\;)" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection attempt detected in sortField'"

SecRule ARGS:sort "@rx (?i)(union|select|insert|update|delete|drop|--|\"|\'|\;)" \
    "id:100002,phase:2,deny,status:403,msg:'SQL Injection attempt detected in sort'"