EUVD-2026-69142
GHSA-hjc3-m6gr-x294
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote SQLi (AV:N/AC:L/PR:N/UI:N) yields full read/write DB access (C:H/I:H); availability is downgraded to A:L since data destruction is possible but not the primary impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection.
This issue affects Products's Store: before 030631b2.
AnalysisAI
SQL injection in TRtek's Products's Store web application (all versions before build 030631b2) lets remote attackers inject arbitrary SQL through unsanitized input, exposing and altering the backend database. The flaw is unauthenticated and network-reachable with a maximal CVSS of 9.8, though no public exploit or active exploitation has been identified and the product appears to be a niche Turkish commercial application with limited deployment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated remote exploitation against a running Products's Store instance, and CWE-89 requires only that the attacker reach an injectable input parameter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The raw signals are severe on paper: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N means an unauthenticated, low-complexity, fully remote attack with high confidentiality and integrity impact, which for an internet-exposed store application should be treated as urgent by any operator running it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to build 030631b2 or later, which is identified in the input as the first fixed version; because the fix is expressed as an opaque build/commit identifier, contact TRtek directly or follow the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0964 to obtain the correct patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine if your organization uses TRtek's Products Store and identify any internet-facing instances; if deployed, immediately restrict network access and enable detailed logging to detect exploitation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today