SQL Injection Vulnerability in Project Worlds Free Download Online Shopping System
CVE-2024-11059

9.8CRITICAL

Key Information:

Vendor

Project Worlds

Status
Free Download Online Shopping System
Vendor
CVE Published:
11 November 2024

What is CVE-2024-11059?

A serious vulnerability has been identified within the Project Worlds Free Download Online Shopping System, specifically within the file /online-shopping-webvsite-in-php-master/success.php. The flaw is related to improper handling of the 'id' parameter, which can be manipulated to execute SQL injection attacks. This allows malicious actors to remotely exploit the system, potentially leading to unauthorized access and data compromise. The vulnerability has been publicly disclosed, raising concerns about its exploitation in the wild. Organizations utilizing affected versions are urged to apply security patches and mitigate risks promptly.

References

https://vuldb.com/?id.283805
https://vuldb.com/?ctiid.283805
https://vuldb.com/?submit.440337

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.