CVE-2020-21809: NukeViet SQL Injection vulnerability in Shops module
Summary
CVE-2020-21809: NukeViet SQL Injection vulnerability. Affects nukeviet/nukeviet across 3 version ranges.
>= 4.0, < 4.0.29
>= 4.1, < 4.1.02
>= 4.2, < 4.2.01
Fixed in 4.0.29, 4.1.02 or 4.2.01, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NukeViet CMS is an open-source content management system designed for creating and managing websites. The Shops module is a component of NukeViet CMS that allows users to set up and manage online stores. This module provides various features for managing products, prices, and orders. However, a SQL Injection vulnerability has been discovered in NukeViet CMS module Shops versions 4.0.29 and 4.3.
Vulnerability Detail
The SQL Injection vulnerability in NukeViet CMS module Shops allows an attacker to execute arbitrary SQL queries through the following parameters: (1) listid parameter in detail.php and (2) group_price or groupid parameters in search_result.php. By manipulating these parameters, an attacker can inject malicious SQL code, potentially leading to unauthorized access, data leakage, or data manipulation. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.0.294.0.29composer require nukeviet/nukeviet:4.0.29 -
>= 4.1, < 4.1.024.1.02composer require nukeviet/nukeviet:4.1.02 -
>= 4.2, < 4.2.014.2.01composer require nukeviet/nukeviet:4.2.01
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The SQL Injection vulnerability in NukeViet CMS module Shops poses a critical security risk to online stores built with NukeViet CMS. Users are strongly advised to apply the necessary updates to their NukeViet CMS installations to mitigate the risk of unauthorized access and data manipulation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nukeviet/nukeviet →
FAQ
NukeViet CMS is an open-source content management system used for creating and managing websites.
The Shops module is a component of NukeViet CMS that allows users to set up and manage online stores.
SQL Injection is a type of vulnerability that allows an attacker to manipulate SQL queries to execute unauthorized actions on a database.
This vulnerability can lead to unauthorized access, data leakage, or data manipulation in NukeViet CMS online stores.
To fix this vulnerability, you need to download the corresponding update package for your NukeViet version and follow the provided instructions for installation.
Related vulnerabilities
Recent vulnerabilities recorded for nukeviet/nukeviet.
