CVE-2023-5294: ECshop order.php sql injection

Published Sep 29, 2023

Updated

A vulnerability has been found in ECshop 4.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/order.php. The manipulation of the argument goodsid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240925 was assigned to this vulnerability.

Affected Software

1 affected component

shopex ecshop=4.1.1

Event History

Sep 29, 2023

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-5294?

The severity of CVE-2023-5294 is classified as high.

What is the affected software for CVE-2023-5294?

The affected software for CVE-2023-5294 is ECshop 4.1.1.

What kind of vulnerability has been found in CVE-2023-5294?

A SQL injection vulnerability has been found in CVE-2023-5294.

How can the vulnerability in CVE-2023-5294 be exploited?

The vulnerability in CVE-2023-5294 can be remotely exploited by manipulating the goods_id argument in the /admin/order.php file.

Are there any references available for CVE-2023-5294?

Yes, there are references available for CVE-2023-5294. Please refer to the following links: [link1](https://github.com/xhcccan/code/issues/2), [link2](https://vuldb.com/?ctiid.240925), [link3](https://vuldb.com/?id.240925)