GitHub Advisoryadvisory · Packagist

GHSA-m8jx-mxf9-2rpw NukeViet SQL Injection vulnerability

CRITICAL Published 2022-05-24 Modified 2024-04-24 Official page ↗
Aliases
CVE-2020-21809
Ecosystem
Packagist
Packages
nukeviet/nukeviet
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-04-24

Affected packages

• Packagist nukeviet/nukeviet: >= 4.0, < 4.0.29 → fixed in 4.0.29 • Packagist nukeviet/nukeviet: >= 4.1, < 4.1.02 → fixed in 4.1.02 • Packagist nukeviet/nukeviet: >= 4.2, < 4.2.01 → fixed in 4.2.01 • Packagist nukeviet/nukeviet: 4.3 (no fix yet)

Description

SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php. Fix Implementation: Download the update package corresponding to the NukeViet version you are using, extract and upload to hosting according to NukeViet's structure: For NukeViet 4.0 Official (4.0.29) For NukeViet 4.1 Official (4.1.02) For NukeViet 4.2 (4.2.01) As for NukeViet 4.3, you can update according to the notice in the admin page or see here: https://nukeviet.vn/vi/news/Tin-tuc/thong-bao-phat-hanh-nukeviet-4- 3-08-613.html

Related

Alias · CVE (1)

  • CVE-2020-21809 SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References