This vulnerability exists in linlinjava litemall up to version 1.8.0 within the list function of the WxGoodsController.java file in the front-end WeChat API component. Improper input handling allows an attacker to perform SQL injection remotely without any authentication or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating it is exploitable over the network with low complexity and no privileges required. Public exploit code is available, increasing the risk of exploitation. No vendor response or patch is currently known.

Successful exploitation can lead to unauthorized SQL queries on the backend database, potentially exposing or modifying sensitive data. Given the medium CVSS score and public exploit availability, this vulnerability poses a moderate risk to affected systems. The lack of vendor response and patch increases exposure duration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or web application firewall (WAF) rules to detect and block SQL injection attempts targeting the affected API endpoint. Monitoring for unusual database activity related to the vulnerable function is advisable.