Description
Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the order_by[] parameter in POST requests to the ajax_list endpoint to potentially extract or modify database information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grocerycrud | Grocery crud | < v2.0.1 | — |
References
- ExploitDB-49985 exploit
- Vendor Homepage product
- Software Download Page product
- VulnCheck Advisory: Grocery crud 1.6.4 - 'order_by' SQL Injection third-party-advisory