CVE-2026-3957: Weimai-Wetapp SQL Injection Vulnerability

CVE-2026-3957 Overview

A SQL injection vulnerability has been identified in xierongwkhd weimai-wetapp, affecting the getLikeMovieList function within the HomeController.java file. This vulnerability allows remote attackers to execute arbitrary SQL commands by manipulating the cat parameter in the affected endpoint. The application fails to properly sanitize user input before incorporating it into database queries, creating a direct path for SQL injection attacks.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to access, modify, or delete database contents, potentially leading to unauthorized data disclosure, data manipulation, or complete database compromise.

Affected Products

• xierongwkhd weimai-wetapp (up to commit 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2)
• weimai-wetapp HomeController Endpoint component
• Java-based backend at source-code/src/main/java/com/moke/wp/wx_weimai/controller/HomeController.java

Discovery Timeline

• March 11, 2026 - CVE-2026-3957 published to NVD
• March 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3957

Vulnerability Analysis

This SQL injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) exists in the getLikeMovieList function of the HomeController component. The vulnerability is network-accessible and can be exploited remotely without user interaction, though it requires elevated privileges to execute.

The vulnerable code path accepts the cat argument from incoming HTTP requests and passes it directly to database queries without adequate input validation or parameterization. This classic injection pattern allows attackers to craft malicious payloads that can alter query logic, extract sensitive information, or perform unauthorized database operations.

The project maintainers were notified about this vulnerability through a GitHub Issue #49 Discussion, but have not yet responded. Since weimai-wetapp uses a rolling release model, no specific version numbers are available for affected or patched releases.

Root Cause

The root cause of this vulnerability is the absence of proper input sanitization and parameterized queries in the getLikeMovieList function. The cat parameter is directly concatenated into SQL statements without validation, escaping, or the use of prepared statements. This allows user-controlled input to break out of the intended query context and inject malicious SQL commands.

Attack Vector

The attack can be executed remotely over the network by sending crafted HTTP requests to the vulnerable endpoint. An attacker with the necessary privileges can manipulate the cat parameter value to inject arbitrary SQL syntax. The exploitation technique involves:

1. Identifying the vulnerable endpoint that calls getLikeMovieList
2. Crafting a malicious cat parameter containing SQL injection payloads
3. Sending the crafted request to extract data, bypass authentication, or modify database contents

Since exploit details have been publicly disclosed, this vulnerability poses an elevated risk to unpatched installations. For technical details on the vulnerability mechanism, refer to the VulDB #350387 - Details report.

Detection Methods for CVE-2026-3957

Indicators of Compromise

• Unusual or malformed requests to endpoints handling the getLikeMovieList function containing SQL syntax in the cat parameter
• Database error messages appearing in application logs indicating query syntax errors
• Unexpected database query patterns or execution of administrative SQL commands
• Anomalous data access patterns or bulk data retrieval from the database

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the cat parameter
• Deploy application-layer monitoring to identify suspicious requests containing SQL keywords (UNION, SELECT, DROP, etc.)
• Enable database query logging and audit trails to detect unauthorized query execution
• Use intrusion detection systems (IDS) with SQL injection signature detection capabilities

Monitoring Recommendations

• Monitor HTTP request logs for the affected HomeController endpoints with particular attention to the cat parameter
• Implement alerting for database errors that may indicate injection attempts
• Track and baseline normal database query patterns to identify anomalous behavior
• Review application logs for repeated failed requests that may indicate attack enumeration

How to Mitigate CVE-2026-3957

Immediate Actions Required

• Restrict network access to the affected endpoint until a patch is available
• Implement input validation and WAF rules to filter SQL injection payloads from the cat parameter
• Consider temporarily disabling the getLikeMovieList functionality if not critical to operations
• Apply the principle of least privilege to database accounts used by the application

Patch Information

No official patch is currently available from the project maintainers. The vulnerability was reported through GitHub Issue #49 Discussion but the project has not yet responded. Since weimai-wetapp uses a rolling release model, users should monitor the GitHub Repository for Weimai for any updates or commits addressing this vulnerability.

Workarounds

• Deploy a Web Application Firewall (WAF) configured with SQL injection detection rules in front of the application
• Implement server-side input validation to sanitize the cat parameter before processing
• Use database connection accounts with minimal required privileges to limit potential impact
• Consider implementing prepared statements or parameterized queries at the application level if source code modifications are possible

# Example WAF rule configuration (ModSecurity)
# Block requests containing SQL injection patterns in the cat parameter
SecRule ARGS:cat "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt detected in cat parameter',\
    log,\
    auditlog"