What is the CVSS score of CVE-2026-5955?

CVE-2026-5955 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of BiEticaret are affected by CVE-2026-5955?

Inrove BiEticaret e-commerce platform versions before 3.3.57 are vulnerable to unauthenticated SQL injection that grants attackers complete read/write access to the database.

How to fix or mitigate CVE-2026-5955?

Within 24 hours: Identify all systems running Inrove BiEticaret and document current versions; notify incident response team and prepare containment procedures. Within 7 days: Implement WAF rules to block SQL injection patterns targeting BiEticaret endpoints; restrict database access to application tier only; enable database query logging. Within 30 days: Deploy Inrove BiEticaret version 3.3.57 or later once released by vendor; conduct forensic log review for evidence of exploitation.

BiEticaret CVE-2026-5955

EUVD-2026-42548 CRITICAL

SQL Injection (CWE-89)

2026-07-09 TR-CERT

GHSA-fq69-8wm6-j469

SQLi Bieticaret

9.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQLi with low complexity (PR:N/AC:L/AV:N); database read/write gives C:H/I:H, and A:H retained per vendor as destructive statements are feasible.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 10:01 vuln.today

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows SQL Injection.

This issue affects BiEticaret: before v3.3.57.

AnalysisAI

SQL injection in Inrove BiEticaret e-commerce platform before v3.3.57 allows remote unauthenticated attackers to inject arbitrary SQL commands (CWE-89) through improperly neutralized input, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Successful exploitation yields full read/write access to the backing database (C:H/I:H/A:H, CVSS 9.8). This flaw was reported by TR-CERT (Turkey's national CERT); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

BiEticaret is a commercial e-commerce/online-store ("e-ticaret") platform developed by the Turkish vendor Inrove Software and Internet Services, identified by CPE cpe:2.3:a:inrove_software_and_internet_services:bieticaret. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into SQL queries without parameterization or adequate escaping, letting an attacker break out of the intended query context. As a web storefront, such applications typically expose numerous query parameters (product IDs, search, category, cart, and account endpoints) that reach the database directly, any of which could be the injectable sink; the advisory does not name the specific parameter or endpoint.

RemediationAI

Vendor-released patch: upgrade BiEticaret to v3.3.57 or later, which is the fixed version indicated in the advisory (TR-CERT TR-26-0519, https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0519). If immediate upgrade is not possible, deploy a WAF rule set to block common SQL injection patterns on the storefront's parameters (accepting that WAF signatures can be bypassed and may cause false positives on legitimate search terms), restrict administrative and non-public endpoints by IP allowlisting, and ensure the database account used by the application runs with least privilege (no DROP/FILE/xp_cmdshell rights) to limit blast radius. Enable database query logging and monitor for anomalous UNION/OR-based patterns, and rotate any credentials or secrets stored in the database after patching in case pre-patch exploitation occurred.