EUVD-2026-43238
GHSA-c64p-m44g-q69p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IPN endpoint with PR:L per CVSS 4.0 source; limited C/I/A impact as SQLi affects only the application database without scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Handler. The manipulation of the argument item_number results in sql injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in AojiaoZero Antaris 1.0 exposes the application database through the PayPal IPN payment callback endpoint, where the _rewardPurchase function fails to sanitize the item_number parameter before incorporating it into SQL queries. An authenticated remote attacker who can send a crafted POST request to /ipn.php can manipulate the underlying database query, potentially reading sensitive records, modifying data, or degrading availability. No public exploit code has been identified at time of analysis, and the vendor did not respond to disclosure, leaving the vulnerability unpatched.
Technical ContextAI
The affected component is the PayPal Instant Payment Notification (IPN) handler, implemented in PHP at /ipn.php within AojiaoZero Antaris 1.0 (CPE: cpe:2.3:a:aojiaozero:antaris:*:*:*:*:*:*:*:*). IPN handlers receive POST callbacks from PayPal containing transaction data including item_number, a merchant-controlled field passed back verbatim by PayPal. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the _rewardPurchase function directly interpolates the unsanitized item_number value into a SQL statement without parameterized queries or input validation. Because IPN requests can be crafted and submitted directly to the endpoint by any remote party without going through PayPal's infrastructure, the attack surface is the PHP application's own HTTP endpoint rather than PayPal's systems.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to the coordinated disclosure. Organizations running AojiaoZero Antaris 1.0 should immediately apply compensating controls at the application or infrastructure layer. The most direct mitigation is to disable or restrict access to /ipn.php via web server configuration (e.g., return 403 for all external requests to this path) if PayPal IPN functionality is not actively required - this eliminates the attack surface entirely but will break payment processing. If IPN must remain functional, implement a web application firewall (WAF) rule to block SQL metacharacters in POST body parameters for this endpoint; note that WAF rules can produce false positives that disrupt legitimate transactions. At the application code level, refactor the _rewardPurchase function to use parameterized queries (PDO or MySQLi prepared statements) and validate item_number against an expected format (e.g., alphanumeric only) before any database interaction. Additionally, verify PayPal IPN authenticity by implementing PayPal's IPN verification step (sending the received payload back to PayPal for confirmation) before processing any transaction data, which prevents forged IPN requests entirely. Refer to VulDB advisory https://vuldb.com/vuln/377809 for any updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today