CVE-2024-24323

2024-02-2700:00:00

mitre

github.com

cve-2024-24323

sql injection

linlinjava litemall

remote attacker

sensitive information

adminordercontroller.java

AI Score

7.6

Confidence

Low

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, orderStatusArray parameters of the AdminOrdercontroller.java component.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:litemall_project:litemall:1.8:*:*:*:*:*:*:*"
    ],
    "vendor": "litemall_project",
    "product": "litemall",
    "versions": [
      {
        "status": "affected",
        "version": "1.8.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]