A flaw has been found in xierongwkhd weimai-wetapp up to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2

CVE-2026-3957 is a SQL injection in xierongwkhd/weimai-wetapp affecting the /home/getLikeMovieList endpoint through the cat parameter. The vulnerable path is visible in HomeController.java, which accepts movieId and cat, and in MovieMapper.java, which builds the query with MyBatis string substitution: cat like '%${cat}%'. The CNA marks all code up to commit 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2 as affected; the repository uses a rolling codebase with no tagged fixed release, and the referenced issue says the maintainers had not responded as of February 26, 2026.

The vendor's *severity bucket* is roughly fair for enterprise prioritization, but the *reasoning* behind it is shaky. The supplied CVSS says PR:H, yet the controller logic serves unauthenticated users when user == null, so the vulnerable path looks reachable without login; that is upward pressure technically. The downward pressure is stronger in the real world: this is a niche, self-hosted movie-ticketing sample project with no evidence of meaningful enterprise install base, no KEV listing, a tiny EPSS, no fixed release, and no internet-scale exposure signal tied to a recognizable product fingerprint.

Why this verdict

• Vendor metric overstates access friction in one place and understates deployment friction in another — the published PR:H looks wrong because the controller serves unauthenticated callers, but the product's tiny real-world deployment footprint pulls the enterprise score back down.
• No meaningful exploitation signal — not in CISA KEV, no campaign reporting found, and EPSS is only 0.00049.
• Reachability is conditional on deliberate self-hosting of a niche app — this is not Exchange, SharePoint, Confluence, or another mass-exposed enterprise platform; most fleets simply do not have this software.

Why not higher?

If this were in a mainstream internet-facing product, I'd push it into HIGH quickly because unauthenticated SQLi is a dependable bug class with straightforward automation. It stays below HIGH because the reachable population appears very small, there is no credible evidence of active exploitation, and the repository has no packaged release channel that suggests widespread production adoption.

Why not lower?

It should not be LOW or IGNORE because the underlying flaw is real, trivially understandable, and publicly weaponized with sqlmap. If your organization actually deployed this backend and exposed /home/getLikeMovieList, the vulnerability can expose or alter the application database and deserves treatment as more than hygiene.

1. Block external access to /home/getLikeMovieList — Put the endpoint behind an allowlist, VPN, or reverse-proxy rule wherever possible. For a MEDIUM verdict there is no mitigation SLA, but if you run this app externally you should still remove public exposure promptly because the PoC is already public; otherwise go straight to the remediation work inside the 365-day window.
2. Add WAF SQLi rules on cat — Apply targeted detection/blocking for SQL metacharacters and common SQLi payloads on the cat parameter at the edge. This is not a substitute for code repair, but it buys time when upstream has no patch; for a MEDIUM finding there is no mitigation SLA — go straight to the 365-day remediation window, unless your instance is publicly exposed.
3. Constrain the DB account — Move the application to a least-privilege database user limited to the minimum schema and verbs required. That directly reduces blast radius if injection is attempted; do it during normal hardening cycles if this app is internal, or immediately if the service is internet-facing.
4. Patch the mapper locally — Because there is no official fixed release identified, defenders running this code should make a local source patch: replace ${cat} with a parameterized form and build wildcards safely in code. For MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window, but if this app is exposed to the internet, treat the local code fix as near-term engineering debt.

Run this on the target host, a checked-out source tree, or an extracted application artifact that contains the Java sources. Invoke it as bash verify-cve-2026-3957.sh /opt/weimai and no root privileges are required unless the files are restricted; it checks for the vulnerable endpoint and the unsafe MyBatis ${cat} query.

#!/usr/bin/env bash
# verify-cve-2026-3957.sh
# Detects vulnerable weimai-wetapp source patterns for CVE-2026-3957.
# Usage: bash verify-cve-2026-3957.sh /path/to/weimai-or-source-root
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / bad usage

set -euo pipefail

ROOT="${1:-}"
if [[ -z "$ROOT" || ! -e "$ROOT" ]]; then
  echo "UNKNOWN"
  echo "Usage: bash verify-cve-2026-3957.sh /path/to/source-or-extracted-app" >&2
  exit 2
fi

HC_FILE=""
MM_FILE=""

# Find likely files
while IFS= read -r -d '' f; do
  case "$f" in
    *HomeController.java) HC_FILE="$f" ;;
    *MovieMapper.java) MM_FILE="$f" ;;
  esac
done < <(find "$ROOT" -type f \( -name 'HomeController.java' -o -name 'MovieMapper.java' \) -print0 2>/dev/null)

if [[ -z "$HC_FILE" && -z "$MM_FILE" ]]; then
  echo "UNKNOWN"
  echo "Could not locate HomeController.java or MovieMapper.java under $ROOT" >&2
  exit 2
fi

has_endpoint=0
has_cat_param=0
has_unsafe_mapper=0
has_safe_mapper=0

if [[ -n "$HC_FILE" ]]; then
  if grep -Eq '@GetMapping\((\{)?"/getLikeMovieList"' "$HC_FILE"; then
    has_endpoint=1
  fi
  if grep -Eq '@RequestParam\("cat"\)\s*String\s+cat' "$HC_FILE"; then
    has_cat_param=1
  fi
fi

if [[ -n "$MM_FILE" ]]; then
  if grep -Fq "cat like '%\${cat}%'" "$MM_FILE"; then
    has_unsafe_mapper=1
  fi
  if grep -Eq "cat like .*#\{cat\}" "$MM_FILE"; then
    has_safe_mapper=1
  fi
fi

# Decision logic
if [[ $has_unsafe_mapper -eq 1 && $has_endpoint -eq 1 && $has_cat_param -eq 1 ]]; then
  echo "VULNERABLE"
  echo "Found /home/getLikeMovieList endpoint and unsafe MyBatis substitution in MovieMapper.java" >&2
  exit 1
fi

if [[ $has_safe_mapper -eq 1 && $has_unsafe_mapper -eq 0 ]]; then
  echo "PATCHED"
  echo "Found parameterized mapper pattern and no unsafe \${cat} substitution" >&2
  exit 0
fi

# If mapper exists but endpoint or pattern is incomplete, return UNKNOWN
if [[ -n "$MM_FILE" || -n "$HC_FILE" ]]; then
  echo "UNKNOWN"
  echo "Files found, but could not conclusively match vulnerable or patched pattern" >&2
  exit 2
fi

echo "UNKNOWN"
exit 2

Sources

1. NVD CVE-2026-3957
2. GitHub issue #49 PoC and disclosure
3. weimai-wetapp repository
4. Vulnerable HomeController.java
5. Vulnerable MovieMapper.java
6. MyBatis FAQ on `${}` vs `#{}` and SQL injection risk
7. CISA Known Exploited Vulnerabilities Catalog
8. OpenCVE record mirroring CVE metadata/title