critical9.1Public exploit code
CVE-2021-37593
PEEL Shopping version 9.4.0 allows remote SQL injection.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PEEL Shopping 9.3.0 - 'id' Time-based SQL Injection2021-07-19 · webapps · php
Impact
PEEL Shopping version 9.4.0 allows remote SQL injection. A public user/guest (unauthenticated) can inject a malicious SQL query in order to affect the execution of predefined SQL commands. Upon a successful SQL injection attack, an attacker can read sensitive data from the database and possibly modify database data.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Peel | Peel Shopping | Version 9.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.netbytesec.com/advisories/UnauthenticatedBlindSQLInjectionVulnerabilityInPEELShopping/
- https://github.com/advisto/peel-shopping/issues/3
- https://github.com/faisalfs10x/CVE-IDs/blob/main/2021/CVE-2021-37593/Proof_of_Concept.md
- http://www.netbytesec.com/advisories/UnauthenticatedBlindSQLInjectionVulnerabilityInPEELShopping/
- https://github.com/advisto/peel-shopping/issues/3
- https://github.com/faisalfs10x/CVE-IDs/blob/main/2021/CVE-2021-37593/Proof_of_Concept.md