SQL Injection in Ecshop

CVE-2009-1622

SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via the order_sn parameter in an order_query action.

Vulnerability class: SQL Injection

EPSS: 0.011 (61.8th percentile) — read the EPSS interpretation.

Affected products

  • Ecshop — versions 2.5.0
  • N/a — versions n/a

Weakness classification (CWE)

References