High · published November 24, 2025
⚠️ A crafty little SQL injection has slipped through in Jonnys Liquor 1.0! An attacker just needs to tweak a single parameter in /detail.php to gain access to your database. 🔓 Think of it like a menu item that lets customers order anything—even items that aren't on the list. If no one checks the order against the official menu, it's easy for someone to sneak in a request for something unexpected! This vulnerability could allow an attacker to manipulate your database, potentially leading to unauthorized data access or even data corruption. While the severity is medium, the risk of exploitation is real, and it could result in a cascade of compromised information!
Think of it like a menu item that lets customers order anything—even items that aren't on the list. If no one checks the order against the official menu, it's easy for someone to sneak in a request for something unexpected! This SQL injection flaw within the GET Parameter Handler allows attackers to manipulate the 'Product' argument in requests sent to /detail.php, enabling them to execute arbitrary SQL queries against the database.
This vulnerability could allow an attacker to manipulate your database, potentially leading to unauthorized data access or even data corruption. While the severity is medium, the risk of exploitation is real, and it could result in a cascade of compromised information! Make sure to patch Jonnys Liquor to the latest version as soon as it's available! Additionally, implement prepared statements in your SQL queries to prevent injection attacks and conduct a thorough audit of the affected component. You've got this! With these steps, you'll be on your way to securing your application in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| anisha/jonnys_liquor | all versions | — |