CVE-2014-5140

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows…

published January 3, 2020

CVSS
—
EPSS
3%
Percentile
85.7
In the wild
Unconfirmed
What it is

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02682 · 85.7th percentile
Published
2020-01-03T19:50Z
EPSS history
Timeline
  • 03 JAN 19:50Z
    The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows…
    cvelistv5