Executive brief
Smartshop, an e-commerce platform, contains a security flaw that allows unauthorized individuals to access its internal database. By sending specially crafted web requests, an attacker can steal sensitive information such as usernames and database structures. This could lead to a total compromise of customer data and business information stored on the site.
Technical details
A SQL injection vulnerability exists in Smartshop 1 due to improper neutralization of user-supplied input in multiple PHP files, including product.php, category.php, and search.php. The application fails to sanitize the 'id' and 'searched' GET parameters before incorporating them into SQL queries. An unauthenticated remote attacker can exploit this by sending UNION-based or time-based blind SQL injection payloads. Successful exploitation allows for the extraction of sensitive data from the database, such as the database name and user credentials. The vulnerability is confirmed in version 1.0 and was publicly disclosed with proof-of-concept exploits.
Affected products
- Smakosh (Ismail Ghallou) Smartshop 1.0 and earlier
Timeline
- 2018-06-02: disclosed: Initial exploit and vulnerability details published on Exploit-DB
- 2026-05-23: advisory: CVE-2018-25341 published to the NVD