Executive brief
PilusCart, an open-source e-commerce platform, contains a security flaw in its comment submission system. An unauthenticated attacker can exploit this to run unauthorized database commands, potentially leading to the theft of sensitive customer or store information. This could result in data breaches and loss of customer trust for online retailers using the software.
Technical details
A SQL injection vulnerability exists in PilusCart 1.4.1 due to improper neutralization of the 'send' parameter within the comment submission functionality. An unauthenticated remote attacker can send specially crafted POST requests containing RLIKE-based boolean SQL injection payloads. This allows the attacker to manipulate backend MySQL queries and exfiltrate sensitive data from the database. The vulnerability is exploitable over the network without user interaction. No official patch has been identified in the advisory, though the software appears to be legacy.
Affected products
- Pilus PilusCart 1.4.1
Timeline
- 2019-02-10: disclosed: Vulnerability discovered and exploit authored by Mehmet EMIROGLU
- 2019-02-13: other: Exploit published on Exploit-DB
- 2026-04-05: advisory: CVE-2019-25672 published by NVD/VulnCheck