{"id":"GHSA-m8jx-mxf9-2rpw","aliases":["CVE-2020-21809"],"title":"NukeViet SQL Injection vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.\n\n### Fix Implementation:\nDownload the update package corresponding to the NukeViet version you are using, extract and upload to hosting according to NukeViet's structure:\nFor NukeViet 4.0 Official (4.0.29)\nFor NukeViet 4.1 Official (4.1.02)\nFor NukeViet 4.2 (4.2.01)\nAs for NukeViet 4.3, you can update according to the notice in the admin page or see here:  https://nukeviet.vn/vi/news/Tin-tuc/thong-bao-phat-hanh-nukeviet-4- 3-08-613.html","severity":"critical","score":9.8,"published":"2022-05-24T19:09:25.000Z","modified":"2024-04-24T20:13:32.883Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"nukeviet/nukeviet","sources":[{"name":"OSV · GHSA-m8jx-mxf9-2rpw","url":"https://osv.dev/vulnerability/GHSA-m8jx-mxf9-2rpw"}],"ranges":[{"events":[{"introduced":"4.0"},{"fixed":"4.0.29"}],"type":"ECOSYSTEM"}],"versions":["4.0.24"],"fixed":["4.0.29"]},{"ecosystem":"Packagist","name":"nukeviet/nukeviet","sources":[{"name":"OSV · GHSA-m8jx-mxf9-2rpw","url":"https://osv.dev/vulnerability/GHSA-m8jx-mxf9-2rpw"}],"ranges":[{"events":[{"introduced":"4.1"},{"fixed":"4.1.02"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.1.02"]},{"ecosystem":"Packagist","name":"nukeviet/nukeviet","sources":[{"name":"OSV · GHSA-m8jx-mxf9-2rpw","url":"https://osv.dev/vulnerability/GHSA-m8jx-mxf9-2rpw"}],"ranges":[{"events":[{"introduced":"4.2"},{"fixed":"4.2.01"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.2.01"]},{"ecosystem":"Packagist","name":"nukeviet/nukeviet","sources":[{"name":"OSV · GHSA-m8jx-mxf9-2rpw","url":"https://osv.dev/vulnerability/GHSA-m8jx-mxf9-2rpw"}],"ranges":[],"versions":["4.3"],"fixed":[]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-21809","https://github.com/nukeviet/module-shops/commit/742c0e0f74364f7250c2a69f0a957d4e6317be68","https://github.com/nukeviet/nukeviet","https://nukeviet.vn/vi/news/Tin-an-ninh/huong-dan-fix-loi-bao-mat-nukeviet-4-va-module-shops-612.html","https://whitehub.net/submissions/1517","https://whitehub.net/submissions/1518"],"sources":[{"name":"OSV","id":"GHSA-m8jx-mxf9-2rpw","modified":"2024-04-24T20:13:32.883170Z","url":"https://osv.dev/vulnerability/GHSA-m8jx-mxf9-2rpw"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:25:34.350Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}