Description
SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of the Address.php component.
Metrics
CVSS 3.1 5.4/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| niushop | niushop | <= 5.3.3 |
References
- https://chiggerlor.substack.com/p/cve-2024-28560-cve-2024-28559Exploit, Third Party Advisory
- https://gitee.com/niushop-team/niushop_b2c_v5Permissions Required
- https://v5.niuteam.cnBroken Link
- https://www.niushop.com/Vendor Advisory
- https://chiggerlor.substack.com/p/cve-2024-28560-cve-2024-28559Exploit, Third Party Advisory
- https://gitee.com/niushop-team/niushop_b2c_v5Permissions Required
- https://v5.niuteam.cnBroken Link
- https://www.niushop.com/Vendor Advisory
Timeline
- Published
- Mar 22, 2024
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed