SQL Injection Flaw in NukeViet CMS Module Shops Affects Multiple Versions
CVE-2020-21809

9.8CRITICAL

Key Information:

Vendor: Nukeviet
Status: Nukeviet
Vendor: CVE Published:; 30 July 2021

What is CVE-2020-21809?

An SQL Injection vulnerability exists in the NukeViet CMS's Shops module, specifically affecting versions 4.0.29 and 4.3. This vulnerability allows attackers to exploit the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php, potentially allowing unauthorized access to database information. It is crucial for users of these versions to take immediate steps to secure their systems against possible exploitation.