Critical severity · published Sep 8, 2024
CVE-2024-8568
Mini-Tmall 1 rewardMapper.select sql injection
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability, which was classified as critical, was found in Mini-Tmall up to 20240901. Affected is the function rewardMapper.select of the file tmall/admin/order/1/1. The manipulation of the argument orderBy leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Mini-Tmall ·
20240901 · source: vendor, CISA
TD
Tmall Demo · Project Team
before 2024-09-01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8568
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8568
Broken Link
https://gitee.com/A0kooo/cve_article/blob/master/Mini-Tmall/Tmall_demo%20OrderController.java%20SQL%20Injection.md
Permissions Required
https://vuldb.com/?ctiid.276798
Third Party Advisory
https://vuldb.com/?id.276798
Third Party Advisory
https://vuldb.com/?submit.401010
More from Mini-Tmall
9.8
CVE-2025-1843
Mini-Tmall ProductMapper.java select sql injection
5.4
CVE-2025-1817
Mini-Tmall Admin Name admin cross site scripting