CVE-2024-0481

MEDIUM

Taokeyun < 1.0.5 - SQL Injection via Goods.php keyword Parameter

Title source: llm
STIX 2.1

Description

A vulnerability was found in Taokeyun up to 1.0.5. It has been rated as critical. Affected by this issue is the function shopGoods of the file application/index/controller/app/store/Goods.php of the component HTTP POST Request Handler. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250586 is the identifier assigned to this vulnerability.

References (3)

Core 3
Core References
Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.250586
Permissions Required, Third Party Advisory signature permissions-required
https://vuldb.com/?ctiid.250586
Broken Link broken-link exploit
https://note.zhaoj.in/share/TKWDqowIoLqs

Scores

CVSS v3 6.3
EPSS 0.0050
EPSS Percentile 39.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
jifeer/taokeyun < 1.0.5
Published Jan 13, 2024
Tracked Since Feb 18, 2026