CVE-2025-15496
📋 TL;DR
This SQL injection vulnerability in guchengwuyue yshopmall allows attackers to manipulate database queries through the 'sort' parameter in the /api/jobs endpoint. Attackers can potentially read, modify, or delete database contents. All users running yshopmall version 1.9.1 or earlier are affected.
💻 Affected Systems
- guchengwuyue yshopmall
📦 What is this software?
Yshopmall by Guchengwuyue
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution through database functions.
Likely Case
Unauthorized data access and extraction of sensitive information from the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Exploit details are publicly disclosed in GitHub issues and vulnerability databases.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Monitor the GitHub repository for updates. Consider applying community fixes if available.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the 'sort' parameter before processing
Implement parameterized queries or input validation in /api/jobs endpoint
Web Application Firewall
allDeploy WAF rules to block SQL injection patterns
Configure WAF to detect and block SQL injection attempts on /api/jobs
🧯 If You Can't Patch
- Restrict network access to the /api/jobs endpoint using firewall rules
- Implement database user with minimal permissions to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check if yshopmall version is 1.9.1 or earlier and if /api/jobs endpoint accepts 'sort' parameterCheck Version:
Check package.json or application configuration for version informationVerify Fix Applied:
Test the /api/jobs endpoint with SQL injection payloads in the 'sort' parameter to ensure they are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from /api/jobs endpoint
- SQL syntax errors in application logs
- Multiple rapid requests to /api/jobs with varying sort parameters
Network Indicators:
- SQL keywords in HTTP parameters to /api/jobs
- Unusual database response sizes from normal queries
SIEM Query:
source="/api/jobs" AND (param="sort" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "INSERT" OR value CONTAINS "DELETE")🔗 References
- https://github.com/guchengwuyue/yshopmall/
- https://github.com/guchengwuyue/yshopmall/issues/39
- https://github.com/guchengwuyue/yshopmall/issues/39#issue-3769727898
- https://vuldb.com/?ctiid.340274
- https://vuldb.com/?id.340274
- https://vuldb.com/?submit.726464
- https://github.com/guchengwuyue/yshopmall/issues/39
- https://github.com/guchengwuyue/yshopmall/issues/39#issue-3769727898
