PT-2025-16359 · Unknown · Hitout Carsale

X1Ongsec · Published 2025-04-15 · Updated 2025-04-15 · CVE-2025-28198

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Hitout car sale version 1.0

Description A SQL injection issue allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component.

Recommendations For version 1.0, consider restricting access to the orderBy parameter in the StoreController.java component to minimize the risk of exploitation. As a temporary workaround, avoid using the orderBy parameter until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-28198

Affected Products

Hitout Carsale

References · 6

• 🔥 https://github.com/Hitout/carsale/issues/24 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-28198 · Security Note
• https://osv.dev/vulnerability/CVE-2025-28198 · Vendor Advisory
• https://twitter.com/CVEnew/status/1912171822424199411 · Twitter Post
• https://t.me/cvedetector/22962 · Telegram Post
• https://t.me/cvetracker/21651 · Telegram Post