CVE-2024-25247
CRITICALNiushop B2B2C V5 - SQL Injection via Latitude and Longitude Parameters
Title source: llmDescription
SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude and longitude parameters.
References (1)
Core 1
Core References
Exploit, Third Party Advisory
https://harryha.substack.com/p/phuong-phap-phan-tich-ma-nguon-tim-lo-hong
Scores
CVSS v3
9.8
EPSS
0.0063
EPSS Percentile
45.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (1)
niushop/b2b2c_multi-business
5.0
Published
Feb 26, 2024
Tracked Since
Feb 18, 2026