CVE-2026-3287 is a SQL injection in youlai-mall 2.0.0, scored CVSS 6.3 (medium). The sortField and sort arguments of the app side product pagination endpoint reach a query unsafely. The record says the vendor did not respond, so no fix is confirmed. Patch the query yourself or isolate the service.
What's affected
The NVD record names youlaitech youlai-mall 2.0.0 and the function listPagedSpuForApp in SpuController.java, in the mall-pms component. The vulnerable input is the sortField or sort argument, and the record says remote exploitation is possible and that the exploit has been made public.
The record states that the vendor was contacted early and did not respond. No fixed version is listed, so verify with the project before assuming a patch.
How to check if you're exposed
Check whether you run youlai-mall 2.0.0 or a fork of it. Then open SpuController.java in the pms module and follow the sort values into the data layer.
If the values are placed into the SQL text, for example in an ORDER BY clause, you are exposed. Parameter placeholders do not work for column names and sort direction, so these values need an allowlist.
Check access logs for the product listing endpoint with unusual sort values.
What to do now
- Add an allowlist for sort field names and the two sort directions, and reject everything else.
- Do not build ORDER BY clauses from raw request text.
- Put the product listing behind a gateway rule that blocks unexpected characters in sort parameters.
- Run the service with a database account that can only read what it needs.
- Watch the project repository for an official fix.
Why it matters
The weaknesses are CWE-89, SQL injection, and CWE-74, injection in general. Sorting is a common place for this bug. Developers parameterize values but forget that a sort column is part of the SQL structure, which placeholders cannot cover.
The score is medium because of limited impact in the vector, but public exploit details and a silent vendor are a bad pairing. The record's KEV flag is false.
Quick check
Why can't I use a placeholder for the sort column?
Placeholders carry values, not identifiers. For columns and directions, map the input to a fixed list of safe options.
Sources
Last reviewed: 19 October 2026.
