← voltar
CVE-2021-47909

Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters

CVSS 8.6 HIGHEPSS 0.3%CWE-89
Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Techraft · Digital Multivendor Marketplace Online Store

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
https://ultimate.multecart.com/https://www.techraft.in/https://www.vulncheck.com/advisories/mult-e-cart-ultimate-sql-injection-via-vulnerable-id-parametershttps://www.vulnerability-lab.com/get_content.php?id=2306