PT-2025-40400 · Yoshop · Yoshop

Zywac · Published 2025-10-02 · Updated 2025-10-07 · CVE-2025-56162

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions YOSHOP version 2.0

Description The software is susceptible to an unauthenticated SQL injection through the goodsIds parameter of the /api/goods/listByIds API endpoint. The getListByIds function improperly concatenates user-supplied input into a database query, specifically within orderRaw('field(goods id, ...)'). This allows attackers to potentially enumerate or modify database data, including obtaining admin password hashes. Exploitation may also enable writing web-shell files or invoking xp cmdshell, potentially leading to remote code execution on servers with elevated database privileges.

Recommendations Apply a fix to properly sanitize user input for the goodsIds parameter in the /api/goods/listByIds endpoint. Address the improper concatenation of user input within the getListByIds function. Review and restrict database privileges to minimize the impact of potential exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-56162

Affected Products

Yoshop

References · 8

• 🔥 https://github.com/ZyWAC/CVE-Disclosures/blob/6b337a44934ffe948275995e9b79158e97c78fc4/2025/YOSHOP2.0/CVE-2025-56162.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56162 · Security Note
• https://osv.dev/vulnerability/CVE-2025-56162 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1973796182745809174 · Twitter Post
• https://gitee.com/xany/yoshop2.0 · Note
• https://t.me/CVEtracker/33957 · Telegram Post
• https://t.me/cveNotify/137704 · Telegram Post
• https://twitter.com/CVEnew/status/1973784634296062000 · Twitter Post