CVE-2024-58316

HIGH

Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-58316 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit.

Description

Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can exploit the vulnerability by sending crafted SQL queries to retrieve sensitive database information by manipulating the user ID parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 12, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

online-shopping-system-advanced

Browse PuneethReddyHC / online-shopping-system-advanced

Default status: unaffected

CVE List1.0affected

Proofs of concept

1

Catalogued exploits

ExploitDBOnline Shopping System Advanced - Sql InjectionExploitDB exploitby Furkan GedikNot analyzed1 file
ExploitDB
PoC details

References

4