CVE-2020-20675

Name of the Vulnerable Software and Affected Versions: Nuishop version 2.3

Description: The issue is a SQL injection vulnerability located in the /goods/getGoodsListByConditions/ endpoint. This vulnerability can potentially be exploited to extract or modify sensitive data from the database.

Recommendations: For Nuishop version 2.3, consider restricting access to the /goods/getGoodsListByConditions/ endpoint until a patch is available. As a temporary workaround, avoid using parameters that could be used to inject malicious SQL code in this endpoint. At the moment, there is no information about a newer version that contains a fix for this vulnerability.