PT-2026-110060 · Unknown · Aspl Product Quotation
CVE-2026-89287
·
Published
2026-10-11
·
Updated
2026-10-16
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ASPL Product Quotation versions prior to 1.1.1
Description
An issue exists where the software fails to sanitize and escape the
quote id parameter before incorporating it into SQL statements. This allows unauthenticated attackers to execute SQL injection, a technique used to interfere with the queries that an application makes to its database, and read arbitrary data from the database.Recommendations
Update ASPL Product Quotation to a version newer than 1.1.0.
Avoid using the
quote id parameter until the plugin is updated.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aspl Product Quotation