CVE-2024-58290
CriticalSummary
Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or manipulate database information by sending crafted payloads to the collections page.
Risk Assessment
An attacker can access or modify sensitive data, potentially leading to data integrity and privacy breaches.
Recommendation
It is recommended to update Xhibiter NFT Marketplace to the latest version and implement input validation and parameterized queries to prevent SQL injection.
Original NVD description (English source)
Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or manipulate database information by sending crafted payloads to the collections page.