CVE-2023-4548

Name of the Vulnerable Software and Affected Versions SPA-Cart eCommerce CMS version 1.9.0.3

Description A critical vulnerability has been found in the GET Parameter Handler component of the /search file. The manipulation of the filter[brandid] argument leads to SQL injection. This issue can be initiated remotely.

Recommendations For version 1.9.0.3, consider disabling the filter[brandid] argument in the /search API endpoint until a patch is available. Restrict access to the /search file to minimize the risk of exploitation. Avoid using the filter[brandid] parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.