CVE-2026-0843 is a SQL injection vulnerability identified in the jiujiujia jjjfood and jjjshop_food software products, specifically affecting versions up to 20260103. The vulnerability resides in the /index.php/api/product.category/index endpoint, where the latitude parameter is improperly sanitized, allowing an attacker to inject malicious SQL code. This injection flaw can be exploited remotely without requiring authentication or user interaction, making it highly accessible to attackers. The vulnerability impacts the confidentiality, integrity, and availability of the backend database by enabling unauthorized data access, modification, or deletion. The products affected are distributed under multiple aliases, complicating detection and mitigation efforts. Despite early notification, the vendor has not responded or issued a patch, and the exploit has been publicly disclosed, increasing the risk of exploitation. The CVSS v4.0 score is 5.3 (medium severity), reflecting the ease of exploitation and potential impact. The vulnerability does not require special privileges or user interaction, but the impact on data security is significant. Organizations using these products should conduct immediate security assessments and implement compensating controls to mitigate risk.

The SQL injection vulnerability allows attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, data manipulation, or deletion. This can compromise sensitive business and customer information, disrupt normal operations, and damage organizational reputation. Since the flaw can be exploited remotely without authentication, attackers can launch automated attacks at scale, increasing the likelihood of widespread compromise. The lack of vendor response and patch availability prolongs exposure, raising the risk of successful exploitation. Organizations relying on jjjfood or jjjshop_food products may face regulatory compliance issues if sensitive data is breached. The distribution of the affected product under multiple names increases the chance that some deployments remain unpatched or unrecognized, further expanding the attack surface. Overall, the vulnerability poses a moderate risk but with potential for significant operational and data security impacts if exploited.

1. Immediately audit all deployments of jjjfood and jjjshop_food products, including those under alternative names, to identify affected versions. 2. Implement Web Application Firewall (WAF) rules specifically designed to detect and block SQL injection attempts targeting the latitude parameter in the /index.php/api/product.category/index endpoint. 3. Employ input validation and parameterized queries or prepared statements in the application code to prevent SQL injection; if source code access is available, prioritize fixing the root cause. 4. Monitor logs for suspicious activity related to the vulnerable endpoint, including unusual query patterns or error messages indicative of injection attempts. 5. Restrict database user permissions to the minimum necessary to limit the impact of potential SQL injection exploitation. 6. If vendor patches become available, apply them promptly. 7. Consider network segmentation and access controls to limit exposure of the vulnerable application to untrusted networks. 8. Educate security teams about this vulnerability and ensure incident response plans include detection and mitigation steps for SQL injection attacks.