A vulnerability was detected in xierongwkhd weimai-wetapp up to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2

CVE-2026-3956 is a SQL injection in xierongwkhd/weimai-wetapp affecting builds up to commit 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2, disclosed on 2026-03-11. The vulnerable path is the admin endpoint /admin/auser/getAdmins, where the keyword parameter is passed through the controller, service, and MyBatis mapper chain without proper neutralization, enabling attacker-controlled SQL execution.

The vendor's MEDIUM 4.7 is slightly generous for enterprise prioritization. Yes, SQLi is always ugly and the public issue shows sqlmap working, but the decisive friction is that this is an admin-side endpoint with PR:H, in a niche open-source movie-ticket application with no evidence of broad enterprise exposure, KEV listing, or active exploitation.

Why this verdict

• Major downward adjustment: requires high privileges — the CVSS PR:H requirement means the attacker already has authenticated admin-grade access, so this is post-initial-access rather than perimeter compromise.
• Population is narrow — weimai-wetapp is a niche GitHub-hosted movie-ticket application, not a common enterprise platform; *inference:* only a tiny fraction of organizations will have this deployed at all.
• Admin backend exposure is likely limited — the vulnerable route is in the admin area, and many real deployments will keep that surface internal, behind VPN, or behind SSO/MFA.
• Public PoC prevents IGNORE — the GitHub issue shows sqlmap exploitation, so if you do run this code, the bug is practical rather than theoretical.
• No active exploitation signal — not KEV-listed, no campaign reporting found, and the supplied EPSS is extremely low.

Why not higher?

Because every critical prerequisite narrows the reachable population: the attacker needs network reachability to the admin app, then authenticated high privileges, then a deployment that still runs the vulnerable code. That compounding friction makes this a poor candidate for urgent fleet-wide interruption unless you specifically operate this app.

Why not lower?

It is still a confirmed SQL injection with a public working PoC, not a noisy scanner false positive. If your organization actually runs this backend, a compromised admin account can likely turn this into direct database read/write abuse, so documenting and fixing it is still warranted.

1. Restrict admin reachability — Move the /admin/ backend behind VPN, bastion, or private network controls and keep it off the public internet where possible. For a LOW verdict there is no SLA (treat as backlog hygiene), but if this app is internet-exposed you should do this during the next routine access-control change window.
2. Enforce strong admin auth — Require SSO and MFA for all admin access because the biggest friction in the exploit chain is authenticated admin possession. For a LOW verdict there is no SLA (treat as backlog hygiene), but this should be part of your standing hardening baseline.
3. Add request filtering on keyword — Apply reverse-proxy or WAF rules to flag or block obvious SQL metacharacters and common sqlmap patterns on /admin/auser/getAdmins. This is not a perfect fix, but it can reduce opportunistic abuse until a code change lands; for LOW, there is no SLA (treat as backlog hygiene).
4. Reduce DB account privileges — Ensure the application database user is not effectively privileged beyond what the admin search function needs. The public issue's root@% result suggests some deployments may be running with dangerous DB permissions; for LOW, there is no SLA (treat as backlog hygiene), but this is a worthwhile cleanup.

Run this on the application host or build workspace that contains the weimai-wetapp source tree or an extracted deployment directory. Invoke it as bash verify-cve-2026-3956.sh /opt/weimai-wetapp with read access only; no root is required unless the app files are permission-restricted.

#!/usr/bin/env bash
# verify-cve-2026-3956.sh
# Checks a local weimai-wetapp source/deployment tree for indicators of CVE-2026-3956.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

set -u

TARGET_DIR="${1:-}"
if [ -z "$TARGET_DIR" ] || [ ! -d "$TARGET_DIR" ]; then
  echo "Usage: bash verify-cve-2026-3956.sh /path/to/weimai-wetapp"
  echo "UNKNOWN"
  exit 3
fi

controller_file="$(find "$TARGET_DIR" -type f -name 'Admin_AdminUserController.java' 2>/dev/null | head -n 1)"
service_file="$(find "$TARGET_DIR" -type f -name 'AdminUserService.java' 2>/dev/null | head -n 1)"
mapper_file="$(find "$TARGET_DIR" -type f \( -name 'AdminUserMapper.xml' -o -name '*AdminUser*Mapper*.xml' \) 2>/dev/null | head -n 1)"

if [ -z "$controller_file" ] && [ -z "$service_file" ] && [ -z "$mapper_file" ]; then
  echo "UNKNOWN - could not locate expected weimai-wetapp admin source files"
  exit 2
fi

has_controller=0
has_service_chain=0
has_unsafe_mapper=0
has_safe_signal=0

if [ -n "$controller_file" ]; then
  if grep -Eq '@GetMapping\(\{"/getAdmins"\}\)|@RequestParam\(value *= *"keyword"' "$controller_file" 2>/dev/null; then
    has_controller=1
  fi
fi

if [ -n "$service_file" ]; then
  if grep -Eq 'getAdmins\(.*keyword\)|getAdminsByKeword\(keyword\)' "$service_file" 2>/dev/null; then
    has_service_chain=1
  fi
  if grep -Eq 'StringUtils|escapeSql|PreparedStatement|sanitize|validator' "$service_file" 2>/dev/null; then
    has_safe_signal=1
  fi
fi

if [ -n "$mapper_file" ]; then
  # MyBatis ${...} is a common unsafe string-substitution signal; #{...} is parameterized.
  if grep -Eq '\$\{[^}]*keyword[^}]*\}' "$mapper_file" 2>/dev/null; then
    has_unsafe_mapper=1
  fi
  if grep -Eq '#\{[^}]*keyword[^}]*\}' "$mapper_file" 2>/dev/null; then
    has_safe_signal=1
  fi
fi

# Decision logic
if [ "$has_controller" -eq 1 ] && [ "$has_service_chain" -eq 1 ] && [ "$has_unsafe_mapper" -eq 1 ]; then
  echo "VULNERABLE - admin getAdmins keyword flow with unsafe MyBatis substitution detected"
  exit 1
fi

if [ "$has_controller" -eq 1 ] && [ "$has_service_chain" -eq 1 ] && [ "$has_safe_signal" -eq 1 ] && [ "$has_unsafe_mapper" -eq 0 ]; then
  echo "PATCHED - keyword flow present but only parameterized/sanitized indicators found"
  exit 0
fi

if [ "$has_controller" -eq 1 ] || [ "$has_service_chain" -eq 1 ]; then
  echo "UNKNOWN - admin keyword flow detected, but mapper evidence is incomplete"
  exit 2
fi

echo "UNKNOWN - insufficient evidence to classify"
exit 2

Sources

1. NVD entry for CVE-2026-3956
2. GitHub issue #48 with public SQLMap PoC
3. xierongwkhd/weimai-wetapp repository
4. OpenCVE record for CVE-2026-3956
5. CVE Details entry
6. CISA Known Exploited Vulnerabilities catalog
7. CWE-74 definition