Description
Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Techraft | Digital Multivendor Marketplace Online Store | 2.4 | — |
References
- Vulnerability Lab Advisory exploit
- Product Homepage product
- Product Homepage product
- VulnCheck Advisory: Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters third-party-advisory