CVE-2024-58316

Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter

State: Published
Severity: 8.7 High
Published: Dec 12, 2025
Updated: Apr 7, 2026
Reserved: Dec 12, 2025

Description

Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can exploit the vulnerability by sending crafted SQL queries to retrieve sensitive database information by manipulating the user ID parameter.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
online-shopping-system-advancedPuneethReddyHC	1.0Affected

References

ExploitDB-51811exploit
Product GitHub Repositoryproduct
VulnCheck Advisory: Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameterthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.