CVE-2024-8568

Mini-Tmall is affected by a SQL injection in the function RewardMapper.select inside tmall/admin/order/1/1, triggered by manipulating the orderBy argument. Affected versions are up to 20240901. Exploitation is remote and has been disclosed publicly; vendor contact occurred with no evident respons...

CVE-2024-40560

The Mini-Tmall (also referred to as Tmall_demo ) application, a Spring Boot-based mall template, is vulnerable to SQL injection in versions prior to v2024.07.03 . The root cause is a lack of validation for externally entered SQL statements. An attacker can exploit this flaw to execute illegal SQL...