CVE-2016-3694

Critical

Published: 15/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the orders_status or customers_status parameter to api/easybill/easybillcsv.php.

Risk Assessment

These vulnerabilities may lead to unauthorized access to the database, potentially resulting in the exposure of sensitive information or data manipulation. Organizations should be aware of the risks associated with potential SQL injection attacks.

Recommendation

It is recommended to install the easybill module or implement appropriate security measures such as input validation and restricting access to critical API files.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the (1) orders_status or (2) customers_status parameter to api/easybill/easybillcsv.php.