CVE-2026-8772: linlinjava litemall Admin Endpoint sql injection
A weakness has been identified in linlinjava litemall up to 1.8.0. Affected is an unknown function of the component Admin Endpoint. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
linlinjava litemall Admin Endpointfrom your environment.Uninstall or remove the Admin Endpoint component where feasible to eliminate the vulnerable functionality.
- Configuration
If the Admin Endpoint is not required, disable it to remove exposure to the SQL injection vulnerability.
linlinjava litemall Admin Endpoint enabled = false - Compensating control
Restrict access to the Admin Endpoint to trusted IP addresses or networks using firewall rules or network ACLs to prevent remote exploitation.
- Compensating control
Deploy a Web Application Firewall (WAF) or application-layer filtering to detect and block SQL injection attempts against the affected Admin Endpoints.
- Operational
Monitor application and database logs and network traffic for signs of SQL injection or exploitation; investigate any indicators of compromise and, if compromise is suspected, rotate database credentials and secrets used by the application.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8772?
CVE-2026-8772 is classified as a high severity vulnerability due to the possibility of remote SQL injection.
What components are affected by CVE-2026-8772?
CVE-2026-8772 affects the Admin Endpoint component of linlinjava litemall versions up to 1.8.0.
How can CVE-2026-8772 be exploited?
CVE-2026-8772 can be exploited remotely by executing a SQL injection attack through the affected Admin Endpoint.
How do I fix CVE-2026-8772?
To mitigate CVE-2026-8772, update linlinjava litemall to version 1.8.1 or later, which addresses the vulnerability.
What should I do if I cannot update to fix CVE-2026-8772?
If unable to update, consider implementing input validation and prepared statements to help protect against SQL injection in CVE-2026-8772.