An SQL injection vulnerability affecting Spryker-based webshops was discovered in the order history search form. It can be exploited by authenticated attackers in order to retrieve information from the database (e.g. customer and administrator login information, order details, etc.). Depending on the configuration of the webshop, access to the file system or even execution of arbitrary commands on the database management system is possible. Version 1.0 is affected.
a765642ade6e4847582e5c9765c8dc2fd16938a137cd46e64cba98b16aa564a7
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed