CVE-2019-9762

CRITICALNuclei

phpshe phpshe Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2019-9762 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 21, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

phpshe

Browse phpshe / phpshe
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALPHPSHE 1.7 - SQL InjectionCVSS 9.8

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.

Remediation

Update to the latest version of PHPSHE or apply security patches to sanitize input parameters.

WeaknessesCWE-89
AuthorsDhiyaneshDK
Template tagscvecve2019phpshesqlivkevvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:phpshe:phpshe:1.7:*:*:*:*:*:*:*
FOFA: app="PHPSHE"
https://gitee.com/koyshe/phpshe/issues/ITC0C https://nvd.nist.gov/vuln/detail/CVE-2019-9762

Source: ProjectDiscovery

References

2