Description (CNA)
Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Techraft / Digital Multivendor Marketplace Online Store | affected 2.4 |
CWE
CWE-89
References
- https://www.vulnerability-lab.com/get_content.php?id=2306
- https://ultimate.multecart.com/
- https://www.techraft.in/
- https://www.vulncheck.com/advisories/mult-e-cart-ultimate-sql-injection-via-vulnerable-id-parameters
ADP enrichment
No English description supplied.