CVE-2025-1843 is a medium severity SQL injection flaw in Mini-Tmall (project_team tmall_demo) up to 20250211, scored 6.3. Attacker supplied input reaches a database query. No fixed version is named, so check the vendor and limit exposure. The record says exploit details are public, and it is not on the CISA KEV list.
What's affected
The CVE record lists Mini-Tmall (project_team tmall_demo) up to 20250211. The weakness sits in the select function in com/xq/tmall/dao/ProductMapper.java, through the orderBy input.
- Product: Mini-Tmall (project_team tmall_demo)
- Affected: up to 20250211
- Fixed: not named in the CVE record
- Severity: Medium, CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
- Known exploited (CISA KEV): no, the record's kev flag is false
The CVE record does not name a fixed version. The vendor advisory, if one exists, should be checked before you rely on any version number. The record states that the vendor was contacted early and did not respond.
The record also says the exploit has been disclosed to the public and may be used. That is a statement about public technical details, not a statement that attacks are underway. KEV status is false, and nothing in the record claims in the wild exploitation.
How to check if you're exposed
Most teams meet this kind of product as a downloaded web application running on PHP or Java. These checks apply.
- Locate every install of Mini-Tmall (project_team tmall_demo). Include staging copies and old demos, which are the ones that tend to stay unpatched.
- Read the version from the product's own files or admin page and compare it with up to 20250211 from the record.
- Check whether the select function in com/xq/tmall/dao/ProductMapper.java is reachable from outside. Your web server or proxy access log, searched for that path, tells you who has requested it.
- If you have the source, find where the orderBy value is used. A quick start is
grep -rn "orderBy" .in the project root, then follow the value to the query. Look for string concatenation into SQL rather than parameter binding.
A dependency scan will not find this class of bug in custom or bundled application code. It needs a code scan or a web scan of the running site.
What to do now
- Check the vendor or project page for a fixed release. The record names none.
- If you maintain the source yourself, change the query that uses the affected input to use parameter binding, and validate the input type before it reaches the query.
- Restrict the affected path at the web server or reverse proxy until a fix is in place, or take the instance off the internet.
- Give the database account used by the application the least privilege it needs. It should not be able to read or change more than the app requires.
- Search web logs for unusual requests to the path and for database errors that appeared around the same time.
- Run a code or web scan on the application to find other places where input reaches SQL the same way.
Why it matters
The weakness is SQL injection, an injection flaw where a value controlled by the user, here orderBy, becomes part of a database query without being bound as data. The database then runs more than the developer meant.
The usual outcome is unauthorised reading or changing of stored records, and sometimes more depending on database rights. The vector says the attack needs a low privileged account (PR:L in the vector). Small PHP and Java web apps are often copied into production from tutorials or demo kits, then forgotten. They rarely get a patch pipeline, which is why this class keeps turning up.
The record maps this to CWE-74 (Injection), CWE-89 (SQL Injection).
Quick check
Is CVE-2025-1843 exploited in the wild?
The record's CISA KEV flag is false, and nothing in the record says attacks are underway. It does say the exploit has been disclosed to the public.
Is there a fix for Mini-Tmall (project_team tmall_demo)?
The CVE record names no fixed version. Check the vendor or project page, and limit access to the affected path until you have one.
Sources
- Safeguard Gold entry for CVE-2025-1843
- CVE record data as supplied for this review (NVD description, CVSS vector, CWE list). The references below are listed in the record and were not all fetched for this page, so confirm details against the vendor before acting.
- https://github.com/qkdjksfkeg/cve_article/blob/main/Tmall_demo/SQL%20injection.md
- https://vuldb.com/?ctiid.298109
- https://vuldb.com/?id.298109
- https://vuldb.com/?submit.504958
Last reviewed: 19 October 2026.
