CVE-2026-5328

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5328", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-01T13:29:33.027Z", "datePublished": "2026-04-02T12:30:16.079Z", "dateUpdated": "2026-04-02T13:31:24.614Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-02T12:30:16.079Z"}, "title": "shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "shsuishang", "product": "modulithshop", "versions": [{"version": "829bac71f507e84684c782b9b062b8bf3b5585d6", "status": "affected"}], "modules": ["ProductItemDao Interface"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the file src/main/java/com/suisung/shopsuite/pt/service/impl/ProductIndexServiceImpl.java of the component ProductItemDao Interface. Executing a manipulation of the argument sidx/sort can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This patch is called 42bcb9463425d1be906c3b290cf29885eb5a2324. A patch should be applied to remediate this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-01T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-01T15:34:37.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "VulDB GitHub Commit Analyzer", "type": "tool"}], "references": [{"url": "https://vuldb.com/vuln/354659", "name": "VDB-354659 | shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354659/cti", "name": "VDB-354659 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780789", "name": "Submit #780789 | Shopsuite modulithshop 829bac71f507e84684c782b9b062b8bf3b5585d6 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/shsuishang/modulithshop/issues/3", "tags": ["issue-tracking"]}, {"url": "https://github.com/shsuishang/modulithshop/issues/3#issue-4081835434", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/shsuishang/modulithshop/commit/42bcb9463425d1be906c3b290cf29885eb5a2324", "tags": ["patch"]}, {"url": "https://github.com/shsuishang/modulithshop/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T13:16:07.430524Z", "id": "CVE-2026-5328", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:31:24.614Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5328", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T13:16:07.430524Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:16:18.318Z"}}], "cna": {"tags": ["x_open-source"], "title": "shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection", "credits": [{"lang": "en", "type": "tool", "value": "VulDB GitHub Commit Analyzer"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "shsuishang", "modules": ["ProductItemDao Interface"], "product": "modulithshop", "versions": [{"status": "affected", "version": "829bac71f507e84684c782b9b062b8bf3b5585d6"}]}], "timeline": [{"lang": "en", "time": "2026-04-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-01T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-01T15:34:37.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354659", "name": "VDB-354659 | shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354659/cti", "name": "VDB-354659 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780789", "name": "Submit #780789 | Shopsuite modulithshop 829bac71f507e84684c782b9b062b8bf3b5585d6 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/shsuishang/modulithshop/issues/3", "tags": ["issue-tracking"]}, {"url": "https://github.com/shsuishang/modulithshop/issues/3#issue-4081835434", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/shsuishang/modulithshop/commit/42bcb9463425d1be906c3b290cf29885eb5a2324", "tags": ["patch"]}, {"url": "https://github.com/shsuishang/modulithshop/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the file src/main/java/com/suisung/shopsuite/pt/service/impl/ProductIndexServiceImpl.java of the component ProductItemDao Interface. Executing a manipulation of the argument sidx/sort can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This patch is called 42bcb9463425d1be906c3b290cf29885eb5a2324. A patch should be applied to remediate this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-02T12:30:16.079Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5328", "state": "PUBLISHED", "dateUpdated": "2026-04-02T13:31:24.614Z", "dateReserved": "2026-04-01T13:29:33.027Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-02T12:30:16.079Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["ProductItemDao Interface"], "product": "modulithshop", "vendor": "shsuishang", "versions": [{"status": "affected", "version": "829bac71f507e84684c782b9b062b8bf3b5585d6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the file src/main/java/com/suisung/shopsuite/pt/service/impl/ProductIndexServiceImpl.java of the component ProductItemDao Interface. Executing a manipulation of the argument sidx/sort can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This patch is called 42bcb9463425d1be906c3b290cf29885eb5a2324. A patch should be applied to remediate this issue."}, {"lang": "es", "value": "Se ha identificado una debilidad en shsuishang modulithshop hasta 829bac71f507e84684c782b9b062b8bf3b5585d6. El elemento impactado es la funci\u00f3n listItem del archivo src/main/java/com/suisung/shopsuite/pt/service/impl/ProductIndexServiceImpl.java del componente ProductItemDao Interface. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento sidx/sort puede conducir a inyecci\u00f3n SQL. El ataque puede realizarse de forma remota. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda usarse para ataques. Este producto utiliza un sistema de lanzamiento continuo para entrega continua, y como tal, la informaci\u00f3n de la versi\u00f3n para las versiones afectadas o actualizadas no se divulga. Este parche se llama 42bcb9463425d1be906c3b290cf29885eb5a2324. Un parche debe aplicarse para remediar este problema."}], "id": "CVE-2026-5328", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5328", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T13:16:07.430524Z", "version": "2.0.3"}}]}, "published": "2026-04-02T13:16:27.400", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/shsuishang/modulithshop/"}, {"source": "cna@vuldb.com", "url": "https://github.com/shsuishang/modulithshop/commit/42bcb9463425d1be906c3b290cf29885eb5a2324"}, {"source": "cna@vuldb.com", "url": "https://github.com/shsuishang/modulithshop/issues/3"}, {"source": "cna@vuldb.com", "url": "https://github.com/shsuishang/modulithshop/issues/3#issue-4081835434"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/780789"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354659"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354659/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "829bac71f507e84684c782b9b062b8bf3b5585d6"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "modulithshop", "source": "cna", "vendor": "shsuishang"}, "product": "shopsuite_modulithshop", "vendor": "shsuishang"}], "analysis": {"en": {"generated_at": "2026-04-02T13:20:34.976723+00:00", "value": {"mitigation_remediation": ["Apply the patch corresponding to commit 42bcb9463425d1be906c3b290cf29885eb5a2324 or upgrade to a release published after this commit.", "Verify that the sidx/sort parameter is now sanitized and that SQL queries are constructed safely, for example by using prepared statements or parameterized queries.", "If an immediate patch cannot be applied, monitor traffic to the listItem endpoint for suspicious SQL\u2011like payloads and implement input validation or a web application firewall rule to block injection attempts.", "Continuously monitor the modulithshop repository, vulnerability databases, and security advisories for further updates or new findings."], "summary": {"action": "Apply Patch", "impact": "Remote SQL Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts the shsuishang modulithshop open\u2011source e\u2011commerce application. All releases up to revision 829bac71f507e84684c782b9b062b8bf3b5585d6 are affected. Because the project follows a rolling release model, no specific version numbers are published; deployments prior to commit 42bcb9463425d1be906c3b290cf29885eb5a2324 remain vulnerable.", "description_and_impact": "The affected code in ProductIndexServiceImpl allows an attacker to supply crafted input in the sidx/sort parameter, causing unsanitized data to be injected into a SQL statement. This flaw can lead to a remote SQL injection attack that is publicly available and may enable attackers to read, modify, or delete data stored in the database. It directly compromises confidentiality and integrity of the application's data records, as reflected by the identified CWE-74 and CWE-89 weaknesses.", "risk_and_exploitability": "With a CVSS score of 5.3 the issue is of medium severity, and no EPSS score is available. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely through the listItem endpoint, and a public exploit has already been released online. Regularly applying the referenced patch or upgrading to a newer commit is essential to mitigate this risk."}}}}, "created": "2026-04-02T20:12:45.374940+00:00", "updated": "2026-04-02T20:21:25.524402+00:00", "vendors": ["shsuishang", "shsuishang$PRODUCT$shopsuite_modulithshop"]}