CVE-2022-38947

SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title parameter, allows attackers to execute arbitrary code

Critical · published December 9, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

🔥 A sneaky SQL injection lurks in Flipkart-Clone-PHP v1.0 that could let attackers run arbitrary code with just a crafted product title! Think of it like a restaurant that accepts any order without verifying the ingredients — one bad order could spoil the entire kitchen’s operations! An attacker could exploit this vulnerability to execute any code on your server, potentially wiping out your database or stealing sensitive information. The consequences could be absolutely devastating for your business, leaving you vulnerable to data breaches and loss of customer trust!

Put simply

Think of it like a restaurant that accepts any order without verifying the ingredients — one bad order could spoil the entire kitchen’s operations! This SQL injection vulnerability in entry.php allows attackers to manipulate the product_title parameter, enabling them to execute arbitrary code on the server without proper validation.

What to do

An attacker could exploit this vulnerability to execute any code on your server, potentially wiping out your database or stealing sensitive information. The consequences could be absolutely devastating for your business, leaving you vulnerable to data breaches and loss of customer trust! Immediately patch your installation to the latest version or upgrade to a secure release. Conduct a thorough review of your code to ensure that all input parameters are properly sanitized and prepared statements are used to prevent SQL injection attacks. You've got this! By taking these steps, you'll be protecting your application and securing your users' data. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00644 · 50.2th percentile
Published
2024-12-09T00:00Z
EPSS history
Timeline
  • 09 DEC 00:00Z
    SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title parameter, allows attackers to execute arbitrary code
    cvelistv5