CVE-2018-20715

The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2019-01-15

Last modified

2024-08-05

Weaknesses

CWE-89

Affected products

• Eshop (Oxid-esales)

References

• https://demo.ripstech.com/main/%28scans/38/51//sidebar:types/38/51/0%29