Vulnerability · Published Dec 12, 2025 · Assigned by VulnCheck
CVE-2024-58316Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter
High 7.5
In plain English
A high-severity SQL injection in online-shopping-system-advanced from PuneethReddyHC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 52.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can exploit the vulnerability by sending crafted SQL queries to retrieve sensitive database information by manipulating the user ID parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PuneethReddyHC | online-shopping-system-advanced | 1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-51811 exploit
- Product GitHub Repository product
- VulnCheck Advisory: Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter third-party-advisory