CVE-2023-4548
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
A critical vulnerability has been found in SPA-Cart eCommerce CMS version 1.9.0.3, affecting an unknown part of the file /search in the GET Parameter Handler component. Manipulation of the argument filter[brandid] leads to SQL injection.
Risk Assessment
This vulnerability allows for remote attack initiation, potentially leading to unauthorized database access and data leakage.
Recommendation
It is recommended to update to the latest version of SPA-Cart eCommerce CMS and monitor logs for potential attack attempts.
Original NVD description (English source)
A vulnerability classified as critical has been found in SPA-Cart eCommerce CMS 1.9.0.3. This affects an unknown part of the file /search of the component GET Parameter Handler. The manipulation of the argument filter[brandid] leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-238059.