vendor:
Super Store Finder
by:
bRpsd
6.1
CVSS
HIGH
Unauthenticated SQL Injection
89
CWE
Product Name: Super Store Finder
Affected Version From: 3.7 and below
Affected Version To: 3.7 and below
Patch Exists: NO
Related CWE:
CPE: a:superstorefinder:super_store_finder:3.7
Platforms Tested: macOS, *nix Darwin Kernel
2023
SuperStoreFinder – Multiple Vulnerabilities
Super Store Finder is a PHP script with a vulnerability that allows unauthenticated SQL Injection attacks. By injecting SQL commands into the USERNAME parameter in the index.php file, attackers can perform boolean-based blind, error-based, or time-based blind SQL injection.
Mitigation:
To mitigate this vulnerability, ensure that user input is properly validated and sanitized before being used in SQL queries. Additionally, consider implementing parameterized queries or prepared statements to prevent SQL injection attacks.
