Description
SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | nukeviet/nukeviet | >= 4.0, < 4.0.29 | 4.0.29 | GHSA-m8jx-mxf9-2rpw |
| Packagist | nukeviet/nukeviet | >= 4.1, < 4.1.02 | 4.1.02 | GHSA-m8jx-mxf9-2rpw |
| Packagist | nukeviet/nukeviet | >= 4.2, < 4.2.01 | 4.2.01 | GHSA-m8jx-mxf9-2rpw |
| Packagist | nukeviet/nukeviet | 4.3 | — | GHSA-m8jx-mxf9-2rpw |