CVE-2025-15496 is a medium severity SQL injection (CVSS 6.3) in guchengwuyue yshopmall up to 1.9.1. The sort argument of the getPage function behind /api/jobs reaches a query unsafely. The record says an exploit is public, and the project has not responded to the issue report.
What's affected
The record lists guchengwuyue yshopmall up to 1.9.1, an open source e-commerce platform. The affected element is the getPage function behind the /api/jobs endpoint, and the input is the sort argument. The CVSS vector needs a low privilege account.
The project was told through a public issue report, number 39 in its GitHub repository, and had not responded when the CVE was published. No fixed version is named.
Sort parameters are a well known weak spot. Databases cannot bind a column name or sort direction as a normal parameter, so developers often join the value into the query, and that is where the injection comes from.
How to check if you're exposed
Check the version from the deployed build or the repository tag, and compare with 1.9.1. Then look at your API logs for requests to the endpoint:
grep "/api/jobs" access.log | grep -i "sort="
Look for sort values that are not plain field names with asc or desc. A normal request names a column. Anything else, such as quote characters or SQL keywords, is worth escalating. Also check database logs for syntax errors raised by the application account.
If you can run an API scan against a test copy, aim it at this endpoint and confirm how it handles unexpected sort values.
What to do now
- Check whether you run yshopmall 1.9.1 or earlier and where the API is reachable from.
- Block or restrict
/api/jobsat the gateway to the accounts and addresses that need it. - If you maintain the code, validate the sort value against an allowlist of column names and directions, never the raw string.
- Review API and database logs for unusual sort values and rotate database credentials.
- Watch the project's issue 39 for a fix and plan an upgrade if one appears.
Why it matters
The record lists CWE-89, SQL Injection, and CWE-74, Injection. The sort value is pasted into the ORDER BY part of a query. The safe pattern is an allowlist: accept only known column names and the words for ascending or descending, and reject everything else.
The score is 6.3 because the attacker needs an account. It is not in CISA's Known Exploited Vulnerabilities catalog per the record. E-commerce data includes customer and order records, which makes any SQL injection in the stack worth closing even at a medium score.
Testing an API endpoint safely
API scanning exercises endpoints like this one with unexpected input and reports how they respond. Run any scan only against systems you own. The free in-browser dependency scan at https://gold.safeguard.sh/scan checks a manifest against known vulnerabilities without installing anything. The Gold directory pages for each CVE and CWE collect the same facts in one place.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is a sort parameter risky?
Column names and sort directions cannot be bound like normal query values, so developers often join them into the SQL. An allowlist is the safe fix.
Is the project aware of the flaw?
The record says it was reported through a public issue and had not responded when the CVE was published.
Sources
Last reviewed: 19 October 2026.
