CVE-2021-46448

Name of the Vulnerable Software and Affected Versions H.H.G Multistore versions 5.1.0 and below

Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/admin/customers.php" API endpoint, specifically when the page and cID variables are used, such as "/admin/customers.php?page=1&cID".

Recommendations For H.H.G Multistore versions 5.1.0 and below, as a temporary workaround, consider restricting access to the "/admin/customers.php" API endpoint until a patch is available. Avoid using the cID variable in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.