PT-2026-3039 · Unknown · Aimeos 2021.10 Lts

CVE-2021-47763

·

Publicado

2026-01-15

·

Atualizado

2026-01-16

CVSS v3.1

8.2

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions Aimeos version 2021.10 LTS
Description A SQL injection issue exists in the json api 'sort' parameter. Attackers can inject malicious database queries by manipulating the 'sort' parameter. Specifically, crafted GET requests sent to the /jsonapi/review endpoint can be used to reveal table and column names.
Recommendations Apply a fix that properly sanitizes the sort parameter in the /jsonapi/review endpoint.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2021-47763
GHSA-HM9J-CGMM-2W36

Produtos afetados

Aimeos 2021.10 Lts