cbcvebase.
CVE-2023-4548
published 2023-08-26

CVE-2023-4548: A vulnerability classified as critical has been found in SPA-Cart eCommerce CMS 1.9.0.3. This affects an unknown part of the file /search of the component GET…

PriorityP272critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
20.11%
97.1th percentile
A vulnerability classified as critical has been found in SPA-Cart eCommerce CMS 1.9.0.3. This affects an unknown part of the file /search of the component GET Parameter Handler. The manipulation of the argument filter[brandid] leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-238059.

Affected

1 ranges
VendorProductVersion rangeFixed in
spa-cartecommerce_cms——

Detection & IOCsextracted from sources · hover to see the quote

url/search?filtered=1&q=11&load_filter=1&filter[brandid]=[SQLi]&filter[price]=100-500&filter[attr][Memory][]=500%20GB&filter[attr][Color][]=Black↗
commandfilter[brandid]=4'XOR(SELECT(0)FROM(SELECT(SLEEP(7)))a)XOR'Z↗
path/search↗
  • →Monitor GET requests to /search endpoint for SQL injection patterns in the filter[brandid] parameter, specifically time-based blind SQLi using SLEEP() payloads. ↗
  • →Detect time-based blind SQL injection attempts using XOR-wrapped SLEEP queries in HTTP GET parameters, characteristic pattern: XOR(SELECT(0)FROM(SELECT(SLEEP(N)))a)XOR ↗
  • →Alert on HTTP GET requests to /search containing both load_filter=1 and filter[brandid] parameters with SQL metacharacters (quotes, parentheses, SQL keywords). ↗
  • ·Vulnerability affects SPA-Cart eCommerce CMS version 1.9.0.3 specifically; detections should be scoped to installations running this version. ↗
  • ·The SQLi injection type confirmed is time-based blind against MySQL >= 5.0.12; response-time anomaly detection (e.g., delays ≥7 seconds) on /search requests can serve as a behavioral signal. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.