The vulnerability is an argument injection flaw in the backup/load function of the Database Setting handler within litemall DbUtil.java. The function improperly accepts and uses the db/password argument without adequate validation, allowing an attacker to craft malicious input that can be injected into the underlying command executed by the system. If exploited, the injection could enable execution of arbitrary commands on the host, yielding remote code execution and full compromise of the affected system’s confidentiality, integrity, and availability.

linlinjava litemall is affected, specifically all releases up to version 1.8.0. No more granular version data is provided beyond this upper bound, so users of 1.8.0 and earlier should consider themselves vulnerable unless they have applied a later fix.

With a CVSS score of 5.1 the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, as the backup/load API can be invoked over the network. While no patch is indicated in the provided data, the public disclosure and lack of vendor response raise concern. Organizations must treat this as a potential exploitation risk until a vendor update is released.