This vulnerability in linlinjava litemall (up to version 1.8.0) involves SQL injection via an unknown function in the Admin Endpoint. Remote attackers can exploit this weakness to inject malicious SQL commands, potentially compromising the database. Multiple endpoints are affected, increasing the attack surface. Although an exploit is publicly available, there is no vendor response or official fix at this time. The CVSS 4.0 base score is 5.1, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The presence of a public exploit increases the risk of attack. However, the vulnerability requires some privileges (PR:H) and has low impact on confidentiality, integrity, and availability, limiting the overall severity to medium.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates and consider implementing application-layer protections such as input validation and web application firewalls to mitigate SQL injection risks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.