CVE-2025-3559 is a medium severity (CVSS 6.3) SQL injection in ghostxbh uzy-ssm-mall 1.0.0, through the orderBy argument of the product list. The vendor did not respond and no fix is listed, so apply your own input controls.
What's affected
The record names ghostxbh uzy-ssm-mall 1.0.0. The affected code is the function ForeProductListController, serving the path /mall/product/0/20, and the manipulated argument is orderBy. The record says the attack can be started remotely.
It adds that the exploit has been disclosed publicly and may be used, and that the vendor was contacted early but never replied. Nothing in the record says the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no fixed version in the record or its references, which are VulDB entries and a write-up. Consider the product unpatched.
How to check if you're exposed
- Look for uzy-ssm-mall in your application servers and source repositories.
- Confirm that the version in use is 1.0.0.
- Check whether the product list page is reachable from the internet. It is a public storefront page, so it usually is.
- Review your logs for unusual values in the orderBy parameter on product list requests, such as long strings or SQL keywords.
- Use the free in-browser dependency scan at gold.safeguard.sh/scan on your project files, and look the CVE up in the Gold directory.
What to do now
- Inventory all copies of the app, including test and internal ones.
- In your own copy of the code, allow only a fixed list of sort columns and directions, and never place the raw orderBy value in a query.
- Use parameterised queries wherever the code builds SQL.
- Reduce the database account rights used by the application, so a successful injection reaches as little as possible.
- Put a web application firewall rule in front of the product list route as a stopgap.
- Plan a migration to a maintained project, since the vendor has not responded.
Why it matters
The class is CWE-89, SQL injection, a subtype of CWE-74, injection. Sort parameters are a common weak spot. Query builders cannot bind a column name as a normal parameter, so developers often paste the value into the query text. If the value is not checked against an allow list, the caller controls part of the query.
The reach of the flaw depends on the database account the app uses. A read-only account limits damage. An account with broad rights makes it worse. The record scores it medium at 6.3, which reflects limited confidentiality, integrity and availability impact in the vector.
With an unresponsive vendor, defenders are on their own. Public exploit details raise the odds that scanners will probe for it.
Quick check
Why is orderBy a risky parameter?
Column names cannot be bound like values, so code often concatenates them into the query. Without an allow list, that opens the door to injection.
Is a fix available for CVE-2025-3559?
The record lists none and says the vendor did not respond. Apply your own code fix and network controls.
Sources
Last reviewed: 18 October 2026.
