What’s Vulnerable › Vulnerabilities

CVE-2014-5140

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-01-03 · updated 2026-06-17
• Weakness: CWE-89

Description

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.

Affected products

• loadedcommerce Loaded7: all versions

References

• http://packetstormsecurity.com/files/128183/Loaded-Commerce-7-Shopping-Cart-SQL-Injection.html
• http://resources.infosecinstitute.com/exploiting-systemic-query-vulnerabilities-attempt-re-invent-pdo/
• http://www.exploit-db.com/exploits/34552
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95791
• https://github.com/loadedcommerce/loaded7/pull/520
• http://packetstormsecurity.com/files/128183/Loaded-Commerce-7-Shopping-Cart-SQL-Injection.html
• http://resources.infosecinstitute.com/exploiting-systemic-query-vulnerabilities-attempt-re-invent-pdo/
• http://www.exploit-db.com/exploits/34552
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95791
• https://github.com/loadedcommerce/loaded7/pull/520

Get alerted when CVE-2014-5140 or the next vulnerability affects your stack