CVE-2024-6452 is a medium severity (CVSS 6.3) SQL injection in linlinjava litemall, versions up to 1.8.0. It is in the admin goods controller and is reachable remotely. The record names no fixed release, so follow the project issue and harden the query path.
What's affected
The record says litemall up to 1.8.0. The code named is AdminGoodscontroller.java, and three arguments are called out as unsafe: goodsId, goodsSn and name. VulDB tracks the issue as VDB-270235.
litemall is an open source e-commerce mall project written in Java. Teams often fork it and run it as the base of a shop, so the fix has to reach your fork and not only the upstream project.
The weakness is CWE-89. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L: a low privilege account is needed, which in an admin controller means someone with a back office login. The record says a public exploit exists and the KEV flag is false.
The record cites the project's GitHub issue 548. That page was not retrievable during review, so I cannot confirm whether a commit fixes it.
How to check if you're exposed
- Check the version in your
pom.xmlor the release tag you built from. - Search your source for the controller and read how the three arguments are used:
grep -rn "AdminGoodsController\|goodsSn" --include=*.java .
- Look at the mapper XML or annotations the controller calls. Values inserted with the dollar-brace syntax in MyBatis are concatenated into SQL, while the hash-brace syntax is bound as a parameter.
- Check access logs for back office requests with oddly shaped values in those fields.
What to do now
- Read the upstream issue and any later commits to see whether a fix exists, and pull it into your fork.
- Where a MyBatis query uses string substitution for these fields, switch it to bound parameters.
- Limit access to the admin interface to staff networks or a VPN.
- Review who holds admin accounts and remove unused ones, since the attack needs one.
- Use a database account for the shop with only the rights it needs.
- Add a unit test that sends an unexpected value to each of the three fields and checks it is treated as data.
Why it matters
A shop's admin area often has the keys to product data, orders and customer records. SQL injection there turns one back office login into broader reading and altering of the store database.
The cause is the same one that has driven injection bugs for years: untrusted text becoming part of a query. In Java projects it often shows up where a search or sort field was added late and the developer used string building to save time.
Quick check
Is there a fixed version?
The record lists none past 1.8.0. Check the project issue for a fix and verify any change in your own fork.
Does it need a login?
The vector says low privileges are required. For the admin goods controller, that means a back office account.
Sources
- NVD record for CVE-2024-6452
- litemall issue 548 and VulDB entry 270235, both cited by the record (not retrievable when this post was prepared)
Last reviewed: 19 October 2026.
