CVE-2017-17873
CriticalSummary
Vanguard Marketplace Digital Products PHP version 1.4 is vulnerable to SQL Injection via the PATH_INFO parameter in the /p URI.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the database and leakage of sensitive information.
Recommendation
It is recommended to update to the latest version of the software and implement input validation to prevent SQL Injection attacks.
Other vulnerabilities in Vanguard Marketplace Digital Products PHP 1.4
See all- CVE-2017-17936High
Vanguard Marketplace Digital Products PHP has a CSRF vulnerability that occurs at the /search endpoint.
- CVE-2017-17874High
Vanguard Marketplace Digital Products PHP version 1.4 allows arbitrary file upload via an 'Add a new product' or 'Add a product preview' action, which can make a .php file accessible under an uploads/ URI.
Original NVD description (English source)
Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.