KomSeo Cart SQL Injection Vulnerability in edit.php

A SQL injection vulnerability has been identified in KomSeo Cart version 1.3. The issue arises in the edit.php file, where the 'my_item_search' parameter can be exploited to inject malicious SQL commands. This vulnerability allows attackers to extract sensitive information from the database using boolean-based blind or error-based injection techniques.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries to extract, modify, or delete database information. In this case, the vulnerability could be exploited using boolean-based blind injection or error-based injection techniques, according to the Exploit Database.

Reproduction

To reproduce this vulnerability, send a POST request to 'edit.php' with the 'my_item_search' parameter. Include a crafted SQL payload that exploits the application's SQL query handling. The injection can be verified by observing the application's response for database error messages or by using a payload that extracts database information.