Iscripts · Iscripts Eswap · CVE-2018-11470
**Name of the Vulnerable Software and Affected Versions**
iScripts eSwap version 2.4
**Description**
The issue is related to SQL injection via the `search.php` API endpoint, specifically the `Told` parameter in the User Panel.
**Recommendations**
For iScripts eSwap version 2.4, consider restricting access to the `search.php` endpoint or avoiding the use of the `Told` parameter until a fix is available.