CVEvulnerability

CVE-2022-24956

6.5 MEDIUM Published 2022-03-29 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-89

Description

An issue was discovered in Shopware B2B-Suite through 4.4.1. The sort-by parameter of the search functionality of b2border and b2borderlist allows SQL injection. Possible techniques are boolean-based blind, time-based blind, and potentially stacked queries. The vulnerability allows a remote authenticated attacker to dump the underlying database.

Affected configurations

• shopware b2b suite (>= 1.0.0 < 1.5.1) • shopware b2b suite (>= 2.0.0 < 2.0.7) • shopware b2b suite (>= 3.0.0 < 3.1.4) • shopware b2b suite (>= 4.2.0 < 4.2.2) • shopware b2b suite (>= 4.3.0 < 4.3.7) • shopware b2b suite (>= 4.4.0 < 4.5.3)

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References