Agri Trading Online Shopping System
Monthly
SQL injection in the Agri Trading Online Shopping System 1.0 admin panel allows unauthenticated remote attackers to manipulate product parameters and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw affects the HTTP POST request handler in admin/productcontroller.php and enables data exfiltration, modification, and potential denial of service.
SQL injection in itsourcecode Agri-Trading Online Shopping System 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'supplier' parameter in /admin/suppliercontroller.php. Exploit code is publicly available, but no evidence of active exploitation. The vulnerability carries a CVSS 4.0 base score of 5.5 (Medium) with limited impact on confidentiality, integrity, and availability.
CVE-2025-6489 is a critical SQL injection vulnerability in itsourcecode Agri-Trading Online Shopping System version 1.0, affecting the /transactionsave.php file through the 'del' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising confidentiality, integrity, and availability of the application database. Public disclosure of this vulnerability exists, and exploitation is feasible without authentication or user interaction.
A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the Agri Trading Online Shopping System 1.0 admin panel allows unauthenticated remote attackers to manipulate product parameters and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw affects the HTTP POST request handler in admin/productcontroller.php and enables data exfiltration, modification, and potential denial of service.
SQL injection in itsourcecode Agri-Trading Online Shopping System 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'supplier' parameter in /admin/suppliercontroller.php. Exploit code is publicly available, but no evidence of active exploitation. The vulnerability carries a CVSS 4.0 base score of 5.5 (Medium) with limited impact on confidentiality, integrity, and availability.
CVE-2025-6489 is a critical SQL injection vulnerability in itsourcecode Agri-Trading Online Shopping System version 1.0, affecting the /transactionsave.php file through the 'del' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising confidentiality, integrity, and availability of the application database. Public disclosure of this vulnerability exists, and exploitation is feasible without authentication or user interaction.
A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.