CVE-2020-21809

SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.58% chance of exploitation in the next 30 days, 75th percentile

Published

2021-07-29

Updated

2024-08-04

Proof-of-concept exploits (2)

• https://whitehub.net/submissions/1517
• https://whitehub.net/submissions/1518

Security advisories

• https://nukeviet.vn/vi/news/Tin-an-ninh/huong-dan-fix-loi-bao-mat-nukeviet-4-va-module-sh…
• nukeviet/module-shops/commit/742c0e0f74364f7250c2a69f0a957d4e6317be68
• advisories/GHSA-m8jx-mxf9-2rpw

References

• CVE Record
• NVD entry