CVE-2024-58316: high-severity vulnerability in PuneethReddyHC online-shopping-system-advanced
Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.6%
Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can exploit the vulnerability by sending crafted SQL queries to retrieve sensitive database information by manipulating the user ID parameter.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
PuneethReddyHC · online-shopping-system-advancedRelated CVEs — PuneethReddyHC online-shopping-system-advanced
In the same product, most dangerous first.