PT-2022-22468 · Unknown · So Filter Shop

Published 2022-07-05 · Updated 2022-07-13 · CVE-2022-34972

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions So Filter Shop versions 3.x

Description The issue is related to multiple blind SQL injection vulnerabilities. These vulnerabilities can be exploited via the att value id, manu value id, opt value id, and subcate value id parameters at the "/index.php?route=extension/module/so filter shop by/filter data" endpoint.

Recommendations For So Filter Shop version 3.x, consider disabling the parameters att value id, manu value id, opt value id, and subcate value id in the "/index.php?route=extension/module/so filter shop by/filter data" endpoint as a temporary workaround until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-34972

Affected Products

So Filter Shop

References · 5

• 🔥 https://packetstormsecurity.com/files/167605/OpenCart-3.x-So-Filter-Shop-By-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-34972 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34972 · Vendor Advisory
• https://t.me/cvenotify/32630 · Telegram Post
• https://t.me/cibsecurity/45623 · Telegram Post