A vulnerability, which was classified as critical, was found in Mini-Tmall up to 20240901. Affected is the function rewardMapper.select of the file tmall/admin/order/1/1. The manipulation of the argument orderBy leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://vuldb.com/?id.276798 | Third Party Advisory |
| https://vuldb.com/?ctiid.276798 | Permissions Required |
| https://vuldb.com/?submit.401010 | Third Party Advisory |
| https://gitee.com/A0kooo/cve_article/blob/master/Mini-Tmall/Tmall_demo%20OrderController.java%20SQL%20Injection.md | Broken Link |
Configurations
History
16 Sep 2024, 13:22
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Project Team
Project Team tmall Demo |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:project_team:tmall_demo:*:*:*:*:*:*:*:* | |
| References | () https://vuldb.com/?id.276798 - Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.276798 - Permissions Required | |
| References | () https://gitee.com/A0kooo/cve_article/blob/master/Mini-Tmall/Tmall_demo%20OrderController.java%20SQL%20Injection.md - Broken Link | |
| References | () https://vuldb.com/?submit.401010 - Third Party Advisory |
08 Sep 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-08 03:15
Updated : 2024-09-16 13:22
NVD link : CVE-2024-8568
Mitre link : CVE-2024-8568
JSON object : View
Products Affected
project_team
- tmall_demo
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')