CVE-2024-24112

The vulnerability results from a lack of proper validation and sanitization of input data passed through the orderDir parameter. An attacker can inject malicious SQL code directly into the query directed at the database. The attack does not require authentication or any user interaction, and the network vector makes it possible to carry out remotely.

An attacker can gain unauthorized access to sensitive data stored in the database, modify or delete its contents, and in certain configurations potentially take control of the database server.

Patches available from the vendor should be applied according to references. It is also recommended to implement parameterized SQL queries (prepared statements) and additional input validation on the server side.

Exrick XMall version 1.1