CVE-2024-2074

MEDIUM

Mini-Tmall <20231017 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-2074. PoCs published by yuziiiiiiiiii.

AI-analyzed exploit summary This repository provides a technical analysis of CVE-2024-2074, detailing a SQL injection vulnerability in the Mini-Tmall project. It includes a walkthrough of the vulnerable code path, from the HTTP parameter to the SQL execution, with supporting images.

Description

A vulnerability was found in Mini-Tmall up to 20231017 and classified as critical. This issue affects some unknown processing of the file ?r=tmall/admin/user/1/1. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255389 was assigned to this vulnerability.

Exploits (1)

nomisec WRITEUP
by yuziiiiiiiiii · poc
https://github.com/yuziiiiiiiiii/CVE-2024-2074

This repository provides a technical analysis of CVE-2024-2074, detailing a SQL injection vulnerability in the Mini-Tmall project. It includes a walkthrough of the vulnerable code path, from the HTTP parameter to the SQL execution, with supporting images.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Mini-Tmall (version 2023/10/17 latest)
Auth required
Prerequisites: Access to the background management user query function · Valid authentication credentials
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.255389
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.255389

Scores

CVSS v3 6.3
EPSS 0.0083
EPSS Percentile 53.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
n/a/Mini-Tmall 20231017
Published Mar 01, 2024
Tracked Since Feb 18, 2026