dingfanzuCMS SQL Injection Vulnerability in checkOrder.php

A SQL injection vulnerability has been identified in dingfanzuCMS version 1.0. The issue arises in the checkOrder.php file within the shopId module, where user input is not properly validated or sanitized before being executed in SQL queries. This flaw allows local attackers to execute arbitrary code by injecting malicious SQL payloads.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing arbitrary code on the server.

Reproduction

To reproduce this vulnerability, send a GET request to '/admin/checkOrder.php' with a crafted 'shopId' parameter that includes SQL injection payloads. The injected SQL code will be executed by the application, demonstrating the SQL injection vulnerability.