CVE-2023-5293 - ECshop leancloud.php sql injection

Back Back to CVE browser

MEDIUM

ECshop leancloud.php sql injection

Published Sep 29, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.53%

Description

A vulnerability, which was classified as critical, was found in ECshop 4.1.5. Affected is an unknown function of the file /admin/leancloud.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240924.

Affected products

Vendor n/a Product ECshop Default
n/a
- Version
  4.1.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

ECshop

n/a

Version	Status	Constraints
4.1.5	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57616
Advisory
https://github.com/xhcccan/code/issues/1
exploitissue-trackingpatchIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.240924
signaturepermissions-requiredPermissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.240924
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57616		Advisory
https://github.com/xhcccan/code/issues/1		exploitissue-trackingpatchIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.240924		signaturepermissions-requiredPermissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.240924		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry