CVE-2024-24112

CRITICALNuclei

Exrick XMall - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2024-24112 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 8, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryCRITICALExrick XMall - SQL InjectionCVSS 9.8

XMall v1.1 was discovered to contain a SQL injection vulnerability via the 'orderDir' parameter.

Impact

Unauthenticated attackers can extract sensitive database information via SQL injection in the orderDir parameter.

Remediation

Update Exrick XMall to a version newer than 1.1.

WeaknessesCWE-89
AuthorsDhiyaneshDk
Template tagscvecve2024xmallsqlivuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:exrick:xmall:1.1:*:*:*:*:*:*:*
FOFA: app="XMall-后台管理系统"
https://github.com/Exrick/xmall/issues/78 https://nvd.nist.gov/vuln/detail/CVE-2024-24112

Source: ProjectDiscovery

References

2