CVE-2023-4548

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3. The impacted element is an unknown function of the file /search of the component GET Parameter Handler. Such manipulation of the argument filter[brandid] leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.1.4 is sufficient to resolve this issue. You should upgrade the affected component.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SPA-Cart	eCommerce CMS	1.9.0.3

References

http://packetstormsecurity.com/files/174344/SPA-Cart-eCommerce-CMS-1.9.0.3-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://codecanyon.net/item/ajax-cart-very-fast-no-page-reloading-many-features-responsive-and-mobile-skin/17109430Product
https://vuldb.com/cve/CVE-2023-4548Third Party Advisory, VDB Entry
https://vuldb.com/submit/197639Third Party Advisory, VDB Entry
https://vuldb.com/vuln/238059Third Party Advisory, VDB Entry
https://vuldb.com/vuln/238059/ctiPermissions Required, VDB Entry
https://www.exploit-db.com/exploits/51714Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/174344/SPA-Cart-eCommerce-CMS-1.9.0.3-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://vuldb.com/?ctiid.238059Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.238059Third Party Advisory, VDB Entry

Timeline

Published: Aug 26, 2023
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-454809.8Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the src parameter in the function sub_47D878 CVE-2023-454819.8Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the firewallEn parameter in the function Set CVE-2023-454829.8Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the urls parameter in the function get_paren CVE-2023-454839.8Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the time parameter in the function compare_p CVE-2023-454849.8Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the shareSpeed parameter in the function fro CVE-2023-45496.1The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can b CVE-2023-454989.8VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.CVE-2023-454999.8VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.CVE-2023-45507.5Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows CVE-2023-455035.3SQL Injection vulnerability in Macrob7 Macs CMS 1.1.4f, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), CVE-2023-45518.8Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection. The AppBuilder's Scheduler fu CVE-2023-455107.5tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new [] vs operator delete) error.