Threats affecting pkg:github/linlinjava/litemall

A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail leads to cross site scripting. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

A cross-site scripting (XSS) vulnerability exists in linlinjava litemall versions 1.5.0, 1.6.0, 1.7.0, and 1.8.0. The flaw is in the AdminTopicController.validate function within the Admin Topic Handler component, specifically in the file litemall-vue/src/views/items/topic/index.vue. This vulnerability can be exploited remotely and may allow an attacker to execute malicious scripts in the context of the affected application. The project has been informed but has not yet responded or issued a fix.

A weakness has been identified in linlinjava litemall up to 1.8.0. Affected is an unknown function of the component Admin Endpoint. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.

A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via the goodsId, goodsSn, and name parameters in AdminOrderController.java.