SQL Injection Vulnerability in Smartshop E-commerce Platform
CVE-2018-25340

8.8HIGH

Key Information:

Vendor

Behance

Status
Smartshop
Vendor
CVE Published:
23 May 2026

Badges

👾 Exploit Exists

What is CVE-2018-25340?

Smartshop 1 is susceptible to SQL injection due to improper validation of the 'id' parameter in GET requests to category.php. This vulnerability allows unauthenticated attackers to inject arbitrary SQL code, enabling them to execute unauthorized SQL queries and potentially retrieve sensitive information from the database, such as usernames and other critical data.

Affected Version(s)

Smartshop 1.0

References

https://www.exploit-db.com/exploits/44823
exploit
https://www.behance.net/gallery/49080415/Smartshop-Free-e...
product
https://github.com/smakosh/Smartshop/archive/master.zip
product

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

L0RD or borna.nematzadeh123@gmail.com
.