CVE-2024-58393: i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of i-Netsolution Readymade Unilevel Ecommerce MLM using the 2024-03-15 build are exposed if attackers can reach /product-details.php over the network.
Does exploitation require an account or user interaction?
No. An unauthenticated attacker can send a GET request and supply a malicious value in the id parameter; no user interaction is required.
What can an attacker do through this issue?
The reported payloads can manipulate database queries and extract database information. The assigned vector indicates high confidentiality impact and low integrity impact, with no availability impact.
Has exploitation been observed?
Yes. The Shadowserver Foundation first observed exploitation evidence on 2024-09-14.