CVE-2026-8771: litemall WeChat API SQL Injection Flaw

CVE-2026-8771 Overview

CVE-2026-8771 is a SQL injection vulnerability affecting linlinjava litemall versions up to 1.8.0. The flaw resides in the list function of litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java, part of the Front-end WeChat API component. Attackers can manipulate request parameters to inject arbitrary SQL into back-end database queries. Exploitation is possible remotely without authentication or user interaction. A public proof-of-concept has been released, increasing the likelihood of opportunistic attacks. The vendor was contacted prior to public disclosure but did not respond. This issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Unauthenticated remote attackers can inject SQL through the WeChat-facing goods listing API, exposing or modifying back-end data in vulnerable litemall deployments.

Affected Products

• linlinjava litemall versions up to and including 1.8.0
• Component: Front-end WeChat API (litemall-wx-api)
• Affected file: WxGoodsController.java (list function)

Discovery Timeline

• 2026-05-18 - CVE-2026-8771 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-8771

Vulnerability Analysis

The vulnerability exists in the list endpoint of WxGoodsController.java within the litemall WeChat-facing API module. The controller accepts user-supplied parameters that flow into SQL query construction without sufficient sanitization or parameterization. An attacker submits crafted input through standard HTTPS requests against the public WeChat goods listing endpoint. The injected SQL fragments execute against the underlying database with the privileges granted to the litemall application user. Impact includes read access to product, user, and order data, with potential write or schema modification depending on the database account's permissions. The exploit code is publicly available on GitHub, and the vendor has not acknowledged the report or issued a fix.

Root Cause

The root cause is improper neutralization of input used to build a downstream SQL query [CWE-74]. Parameters routed into the list handler are concatenated or interpolated into query logic rather than bound through prepared statements or an ORM safe-binding mechanism. This permits special SQL metacharacters to alter query structure.

Attack Vector

The attack vector is network-based. The vulnerable endpoint is exposed by the litemall-wx-api service, which front-ends the WeChat mini-program. An unauthenticated remote attacker sends a single HTTP request with malicious parameter values to trigger the injection. No privileges, user interaction, or local access are required.

No verified exploitation code is reproduced here. Technical details and the public proof-of-concept are available at the GitHub Gist PoC Code and the VulDB Vulnerability #364396 entry.

Detection Methods for CVE-2026-8771

Indicators of Compromise

• HTTP requests to litemall WeChat API paths corresponding to the WxGoodsControllerlist endpoint containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA.
• Abnormally long response times on the goods listing endpoint, indicative of time-based blind SQL injection.
• Database error messages or stack traces surfaced in application logs originating from the list handler.
• Outbound database queries referencing schema metadata tables initiated from the litemall application user.

Detection Strategies

• Inspect web access logs and WAF telemetry for parameter values containing SQL syntax targeting the wx/goods/list route.
• Correlate request bursts from a single source against the WeChat API with elevated 500-class responses or database error signatures.
• Apply signature-based detection for common sqlmap user-agents and payload patterns against the litemall front-end host.

Monitoring Recommendations

• Forward litemall application and database query logs to a centralized analytics platform for retention and search.
• Enable database audit logging for unexpected UNION SELECT, schema enumeration, or queries against sensitive tables from the litemall service account.
• Alert on new outbound connections from the litemall host that deviate from baseline operational traffic.

How to Mitigate CVE-2026-8771

Immediate Actions Required

• Restrict public exposure of the litemall-wx-api endpoint to trusted networks or place it behind an authenticated gateway until a fix is available.
• Deploy WAF rules that block SQL injection payloads targeting parameters consumed by the WxGoodsControllerlist handler.
• Reduce the litemall database account's privileges to read-only on non-essential tables and revoke DDL rights where possible.
• Review database and application logs for prior exploitation activity using the indicators listed above.

Patch Information

At the time of publication, no vendor patch is available. The maintainer of linlinjava litemall did not respond to disclosure outreach. Operators should track the upstream linlinjava litemall repository for fixes and consider applying a private patch that converts the affected query in WxGoodsController.java to use parameterized statements via the MyBatis mapper rather than dynamic SQL concatenation.

Workarounds

• Disable or firewall the WeChat goods listing endpoint if the WeChat mini-program is not in production use.
• Add server-side input validation that rejects non-numeric values for numeric parameters and constrains string parameters to an allowlist of expected characters.
• Place the application behind a reverse proxy that enforces strict parameter schemas and rate limiting on the affected route.
• Rotate database credentials and review data access if exploitation is suspected.

# Example WAF rule (ModSecurity) blocking common SQLi tokens on the litemall WeChat goods list endpoint
SecRule REQUEST_URI "@beginsWith /wx/goods/list" \
  "phase:2,deny,status:403,id:1008771,\
   chain,msg:'Potential SQLi against litemall WxGoodsController (CVE-2026-8771)'"
  SecRule ARGS "@rx (?i)(union(\s|\+)+select|sleep\(|information_schema|--|';)" \
    "t:none,t:urlDecodeUni"