SQL Injection in itsourcecode Agri-Trading Online Shopping System 1.0

Summary

A security flaw in itsourcecode Agri-Trading Online Shopping System 1.0 allows hackers to inject malicious SQL code, potentially stealing or altering sensitive data. This puts customer information and system integrity at risk. Update the software to the latest version to fix this vulnerability.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
adonesevangelista	agri-trading_online_shopping_system	1.0	–

Original title

A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of the component HTTP POST Request Handle...

Original description

A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Product results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.

nvd CVSS2.0 7.5

nvd CVSS3.1 9.8

nvd CVSS4.0 6.9

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/wan1yan/cve/issues/3 Exploit Issue Tracking Mitigation Third Party Advisory
https://itsourcecode.com/ Product
https://vuldb.com/?ctiid.347104 Permissions Required VDB Entry
https://vuldb.com/?id.347104 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754556 Third Party Advisory VDB Entry