PT-2021-3914 · Unknown · Online Shopping Alphaware

Gg Gg · Published 2021-06-02 · Updated 2021-06-09 · CVE-2020-25362

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Online Shopping Alphaware version 1.0

Description The issue is related to the id parameter in the web application, which is vulnerable to an Error-Based blind SQL injection. This vulnerability allows an attacker to execute arbitrary SQL commands and gain access to sensitive data. The vulnerability is specifically located in the /alphaware/details.php path, allowing an attacker to retrieve all databases.

Recommendations For Online Shopping Alphaware version 1.0, consider restricting access to the /alphaware/details.php path until a patch is available. Additionally, as a temporary workaround, avoid using the id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2021-04429

CVE-2020-25362

Affected Products

Online Shopping Alphaware

References · 8

• 🔥 https://exploit-db.com/exploits/48771 · Exploit
• https://osv.dev/vulnerability/CVE-2020-25362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25362 · Security Note
• https://bdu.fstec.ru/vul/2021-04429 · Security Note
• https://sourcecodester.com/download-code?nid=14368&title=Online+Shopping+Alphaware+in+PHP%2FMysql · Note
• https://sourcecodester.com/download-code?nid=14368&title=Online+Shopping+Alphaware+in+PHP%2FMysql · Note
• https://vuldb.com/?id.176213 · Note
• https://sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html · Note