PT-2026-28243 · Undefined · Undefined

Published 2026-03-26 · Updated 2026-05-01 · CVE-2018-25206

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions KomSeo Cart version 1.3

Description An SQL injection flaw allows attackers to inject SQL commands via the my item search parameter in the 'edit.php' endpoint. By submitting POST requests with malicious payloads, attackers can extract sensitive database information using error-based or boolean-based blind injection techniques, where the latter involves asking the database true/false questions to infer data.

Recommendations As a temporary workaround, avoid using the my item search parameter in the 'edit.php' endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-25206

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25206 · Security Note
• https://sitemakin.com · Note
• https://t.me/cveNotify/161743 · Telegram Post
• https://vulncheck.com/advisories/komseo-cart-sql-injection-via-edit-php · Note
• https://exploit-db.com/exploits/44753 · Note