CVE-2016-1154

Critical

Published: 19/02/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Risk Assessment

Attackers can exploit this vulnerability to gain unauthorized access to the database, potentially leading to data loss or system compromise.

Recommendation

It is recommended to update the Help plug-in to the latest version to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.