What’s Vulnerable › Vulnerabilities

CVE-2024-58316: Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-12 · updated 2026-06-17
• Weakness: CWE-89

Description

Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can exploit the vulnerability by sending crafted SQL queries to retrieve sensitive database information by manipulating the user ID parameter.

Affected products

• PuneethReddyHC Online Shopping System Advanced: 1.0

References

• https://github.com/PuneethReddyHC/online-shopping-system-advanced
• https://www.exploit-db.com/exploits/51811
• https://www.vulncheck.com/advisories/online-shopping-system-advanced-sql-injection-via-payment-success-parameter

Get alerted when CVE-2024-58316 or the next vulnerability affects your stack