CVE-2025-15496: guchengwuyue yshopmall jobs getPage sql injection
A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15496?
CVE-2025-15496 is classified as a high-severity vulnerability due to its potential for SQL injection exploits.
How do I fix CVE-2025-15496?
To fix CVE-2025-15496, update the guchengwuyue yshopmall application to version 1.9.2 or later.
What are the potential impacts of CVE-2025-15496?
The potential impacts of CVE-2025-15496 include unauthorized data access and manipulation due to remote SQL injection attacks.
What versions of guchengwuyue yshopmall are affected by CVE-2025-15496?
CVE-2025-15496 affects all versions of guchengwuyue yshopmall up to and including 1.9.1.
Is remote exploitation possible with CVE-2025-15496?
Yes, CVE-2025-15496 can be exploited remotely by manipulating parameters sent to the affected API.