Vulnerability · Published May 16, 2024 · Assigned by INCIBE
CVE-2024-4826SQL injection vulnerability in Simple PHP Shopping Cart
Critical 9.8
In plain English
A critical-severity SQL injection in Simple PHP Shopping Cart from Asaancart. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all the information stored in the database by sending a specially crafted SQL query, due to the lack of proper sanitisation of the category_id parameter in the category.php file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Asaancart | Simple PHP Shopping Cart | 0.9 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H