CVE-2023-39560

CriticalCVSS 9.8

Published: 28/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 26/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

4.11%

89th percentile - higher than 89% of all known CVEs

Summary

A SQL injection vulnerability was discovered in ECTouch v2 via the $arr['id'] parameter in the insert.php file. An attacker can exploit this flaw to execute unauthorized database queries.

Risk Assessment

The risk includes potential leakage of sensitive data, modification or deletion of database records, and possible privilege escalation within the system.

Recommendation

Immediately update ECTouch to the latest version and implement parameterized SQL queries or input validation for the id parameter.

Original NVD description (English source)

ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.