Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Loaded Commerce SQL注入漏洞
Vulnerability Description
Loaded Commerce是美国Loaded Commerce公司的一套开源的电子商务平台。 Loaded Commerce 7版本中存在SQL注入漏洞，该漏洞源于includes/classes/database.php文件中的‘bindReplace’函数没有正确处理‘:’字符。攻击者可借助First name和Last name字段利用该漏洞控制应用程序，访问或修改数据，或利用底层数据库中潜在的漏洞。
CVSS Information
N/A
Vulnerability Type
N/A