This vulnerability affects the backup/load function in the litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java file of linlinjava litemall up to version 1.8.0. Specifically, manipulation of the db/password argument leads to argument injection, which can be exploited remotely. The CVSS 4.0 base score is 5.1 (medium severity), indicating a network attack vector with low complexity and no user interaction, but requiring high privileges. The vendor was contacted but did not provide a response or patch. No official remediation level is indicated.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject arguments via the db/password parameter, potentially affecting database operations related to backup and load functions. The impact is rated medium severity with limited scope and complexity. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected function and monitor for suspicious activity related to database backup/load operations. Avoid exposing the vulnerable component to untrusted networks until a patch or official mitigation is released.