Description
WebOfisi E-Ticaret 4.0 contains an SQL injection vulnerability in the -urun- GET parameter of the endpoint that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL payloads through the -urun- parameter to execute boolean-based blind, error-based, time-based blind, and stacked query attacks against the backend database.
CVSS 8.2EPSS 0.271%Risk 0.84
View source- Published
- 2026-03-26 12:16:06
- Affected versions
- <=4.0
- Type
- Package
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N