CVE-2026-38808 Details

A SQL injection vulnerability has been identified in uzy-ssm-mall version 1.1.0. This vulnerability allows remote attackers to access sensitive information by exploiting the ProductMapper.xml and OrderUtil.java components. The issue arises because multiple endpoints accept an external 'orderBy' parameter, which is directly passed into 'OrderUtil' and concatenated into the 'ORDER BY' clause in MyBatis XML without proper validation. This creates a dynamic SQL injection risk, where attackers can manipulate the SQL query to their advantage.

To address this vulnerability, it is recommended not to concatenate user-controlled input into SQL statements using dynamic placeholders. Instead, use safe parameterization or strict server-side mapping. Additionally, implement a whitelist of allowed sortable field names for the 'orderBy' parameter and reject any unexpected SQL keywords, expressions, or special characters in sorting-related input before it reaches the data access layer.