Smartshop 1 SQL Injection via product.php id Parameter
Vulnerability Description
Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to product.php with union-based SQL injection payloads in the id parameter to extract sensitive database information including usernames and database names.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-25341
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- L0RD or borna.nematzadeh123@gmail.com
References
Affected Vendor
Behance
View all reports →