Log in Start free

Vulnerability · Published Feb 8, 2025 · Assigned by VulDB

CVE-2025-1116Dreamvention Live AJAX Search Free live_search.searchresults search sql injection

High 7.3

In plain English

A high-severity SQL injection in Live AJAX Search Free from Dreamvention. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.4%top 67.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/live_search/module/live_search.searchresults. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

VendorProductVersions
Dreamvention Live AJAX Search Free 1.0.01.0.11.0.21.0.31.0.41.0.51.0.6

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References