Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Smartshop 1 allows attackers to steal user data

CVE-2018-25340 · published 5 months ago
Summary

An attacker can use a specific type of malicious input to extract sensitive user data from Smartshop 1, including usernames. This can happen without needing a password. To protect your data, update Smartshop 1 to the latest version.

Original advisory text
Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GE...
Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to category.php with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames and other data.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published23 May 2026
Updated4 Nov 2026
First seen26 May 2026
Sources
CVE-2018-25340 · NVD
Track software like this
Free during beta