CVE-2024-25247

EUVD-2024-22583
SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude and longitude parameters.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
niushopb2b2c_multi-business
5.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://harryha.substack.com/p/phuong-phap-phan-tich-ma-nguon-tim-lo-hong
https://harryha.substack.com/p/phuong-phap-phan-tich-ma-nguon-tim-lo-hong