NukeViet SQL Injection vulnerability
Impact
SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 4.0 before 4.0.29Ecosystem versions | 4.0.29 |
| From 4.1 before 4.1.02Ecosystem versions | 4.1.02 |
| From 4.2 before 4.2.01Ecosystem versions | 4.2.01 |
Version evidence: OSV · GHSA-m8jx-mxf9-2rpw
View original version evidence (2 explicit versions)
Original source description
SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
Fix Implementation:
Download the update package corresponding to the NukeViet version you are using, extract and upload to hosting according to NukeViet's structure: For NukeViet 4.0 Official (4.0.29) For NukeViet 4.1 Official (4.1.02) For NukeViet 4.2 (4.2.01) As for NukeViet 4.3, you can update according to the notice in the admin page or see here: https://nukeviet.vn/vi/news/Tin-tuc/thong-bao-phat-hanh-nukeviet-4- 3-08-613.html
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2020-21809
- Patch github.com/nukeviet/module-shops/commit/742c0e0f74364f7250c2a69f0a957d4e6317be68
- Source reference github.com/nukeviet/nukeviet
- Source reference nukeviet.vn/vi/news/Tin-an-ninh/huong-dan-fix-loi-bao-mat-nukeviet-4-va-module-shops-612.html
- Source reference whitehub.net/submissions/1517
- Source reference whitehub.net/submissions/1518