~ / search / GHSA-m8jx-mxf9-2rpw

GHSA-m8jx-mxf9-2rpw

NukeViet SQL Injection vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-21809

Packages

EcosystemPackageAffectedFixed in
Packagist nukeviet/nukeviet >= 4.0, < 4.0.29 4.0.29
Packagist nukeviet/nukeviet >= 4.1, < 4.1.02 4.1.02
Packagist nukeviet/nukeviet >= 4.2, < 4.2.01 4.2.01
Packagist nukeviet/nukeviet 4.3 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php. ### Fix Implementation: Download the update package corresponding to the NukeViet version you are using, extract and upload to hosting according to NukeViet's structure: For NukeViet 4.0 Official (4.0.29) For NukeViet 4.1 Official (4.1.02) For NukeViet 4.2 (4.2.01) As for NukeViet 4.3, you can update according to the notice in the admin page or see here: https://nukeviet.vn/vi/news/Tin-tuc/thong-bao-phat-hanh-nukeviet-4- 3-08-613.html

References

External links from the advisory. They lead to third-party sites.