ECshop order.php sql injection
CVE-2023-5294

4.7MEDIUM

Key Information:

Vendor: Shopex
Status: Ecshop
Vendor: CVE Published:; 29 September 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-5294?

A significant SQL injection vulnerability exists in ECshop version 4.1.1 due to improper handling of the 'goods_id' parameter in the /admin/order.php file. This flaw allows an attacker to manipulate SQL queries executed by the web application, potentially leading to unauthorized data access or data manipulation. The vulnerability can be exploited remotely, making it imperative for users of ECshop 4.1.1 to take necessary precautions, such as applying patches or upgrading to mitigate potential risks. Awareness of this vulnerability is crucial for maintaining the security of web applications powered by ECshop.

Affected Version(s)

ECshop 4.1.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-5294 - Proof of Concept

References

https://vuldb.com/?id.240925

vdb-entrytechnical-description

https://vuldb.com/?ctiid.240925

signaturepermissions-required

https://github.com/xhcccan/code/issues/2

exploitissue-trackingpatch

CVSS V3.1

Score:

4.7

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

CVSS V3.0