What’s Vulnerable › Vulnerabilities

CVE-2024-58393: i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-29
• Weakness: CWE-89

Description

i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.

Affected products

• i-Netsolution Readymade Unilevel Ecommerce MLM: 2024-03-15 build

References

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/readymade-unilevel-sqli.yaml
• https://i-netsolution.com/product-details/readymade-unilevel-ecommerce-mlm
• https://packetstorm.news/files/id/179886/
• https://www.vulncheck.com/advisories/i-netsolution-readymade-unilevel-ecommerce-mlm-sql-injection-via-product-details-php

Get alerted when CVE-2024-58393 or the next vulnerability affects your stack