CVE-2024-24323

CVE-2024-24323 is a SQL injection vulnerability affecting linlinjava litemall v.1.8.0. The issue arises in AdminOrdercontroller.java where the nickname, consignee, orderSN, and orderStatusArray parameters can be exploited by an attacker to access sensitive information. Multiple sources (NVD, Red ...

CVE-2024-46382

CVE-2024-46382 describes a SQL injection in linlinjava’s Litemall 1.8.0. The vulnerability affects the AdminGoodsController.java parameters goodsId, goodsSn, and name, enabling a remote attacker to exfiltrate sensitive information. The root cause is a missing/insufficient input sanitization or pa...

CVE-2018-18434

The CVE-2018-18434 vulnerability affects Litemall 0.9.0 in the litemall-wx-api component, specifically in WxStorageController.java, where a directory traversal (../) enables arbitrary file download. This is a network-accessible issue with a high-severity impact per CVSS (C:H/I:N/A:N) and partial ...