CVE-2023-4445
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A critical vulnerability has been found in Mini-Tmall up to version 20230811, affecting some unknown functionality of the file product/1/1?test=1&test2=2&. Manipulation of the argument orderBy leads to SQL injection.
Risk Assessment
An attacker may remotely exploit this vulnerability, posing a serious threat to the security of data within the organization.
Recommendation
It is recommended to immediately update Mini-Tmall to the latest version to mitigate this vulnerability.
Original NVD description (English source)
A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20230811. Affected by this issue is some unknown functionality of the file product/1/1?test=1&test2=2&. The manipulation of the argument orderBy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-237566 is the identifier assigned to this vulnerability.