Isotope Core
Monthly
Blind SQL injection in Isotope eCommerce through 2.9.10 allows authenticated Contao backend users with Isotope module permissions to manipulate backend SQL queries and extract arbitrary database contents, including password hashes from the tl_user table. Exploitation requires a legitimate backend session with Isotope permissions and is limited to blind conditional or time-based techniques; no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data. The independent assessment rates confidentiality impact as high, integrity impact as low, and availability impact as none, emphasizing that this is a genuine but access-gated vulnerability and not a mass-exploitation threat.
Unauthenticated remote attackers can read other customers' order records - including billing addresses, customer details, and purchased downloadable files - on Isotope eCommerce installations through 2.9.10 that accept guest orders, because order identifiers are generated from PHP's time-seeded uniqid() function and the guest order-details module performs no ownership verification. Exploitation requires guessing a valid uid value, which is why the flaw carries high attack complexity rather than being trivially scriptable, but no authentication or user interaction is needed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the practical exposure is a bounded but genuine confidentiality risk confined to shops exposing guest checkout.
Blind SQL injection in Isotope eCommerce through 2.9.10 allows authenticated Contao backend users with Isotope module permissions to manipulate backend SQL queries and extract arbitrary database contents, including password hashes from the tl_user table. Exploitation requires a legitimate backend session with Isotope permissions and is limited to blind conditional or time-based techniques; no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data. The independent assessment rates confidentiality impact as high, integrity impact as low, and availability impact as none, emphasizing that this is a genuine but access-gated vulnerability and not a mass-exploitation threat.
Unauthenticated remote attackers can read other customers' order records - including billing addresses, customer details, and purchased downloadable files - on Isotope eCommerce installations through 2.9.10 that accept guest orders, because order identifiers are generated from PHP's time-seeded uniqid() function and the guest order-details module performs no ownership verification. Exploitation requires guessing a valid uid value, which is why the flaw carries high attack complexity rather than being trivially scriptable, but no authentication or user interaction is needed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the practical exposure is a bounded but genuine confidentiality risk confined to shops exposing guest checkout.