CVE-2024-12792

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in Codezips E-Commerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file newadmin.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Codezips	E-Commerce Site	1.0

References

https://github.com/laowuzi/cve/blob/main/E-commerce/E-commerce-newadmin.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.288973Permissions Required
https://vuldb.com/?id.288973Third Party Advisory
https://vuldb.com/?submit.465715Third Party Advisory

Timeline

Published: Dec 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-127934.3A vulnerability, which was classified as problematic, has been found in PbootCMS up to 5.2.3. Affected by this issue is some unknown functio CVE-2024-127949.8A vulnerability, which was classified as critical, was found in Codezips E-Commerce Site 1.0. This affects an unknown part of the file /admi CVE-2024-127965.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Holistic IT, Consultancy Coop. CVE-2024-127977.4Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticate CVE-2024-127985.9ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java app CVE-2024-1279910.0Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege CVE-2024-128004.8The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as adm CVE-2024-128012.4Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, al CVE-2024-128029.1SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Secur CVE-2024-128037.2A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and poten CVE-2024-128057.2A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads t CVE-2024-128064.9A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file.