Description
i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.
Published: 2026-10-22
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Data exfiltration via unauthenticated SQL injection
Action: Immediate Patch
AI Analysis

Impact

The 2024‑03‑15 build of i‑Netsolution Readymade Unilevel Ecommerce MLM contains an SQL injection flaw in its product‑details.php page. Unauthenticated attackers can send crafted GET requests with the ‘id’ parameter and perform boolean‑based, stacked, or time‑based SLEEP injections to read sensitive database fields. The vulnerability stems from inadequate input validation (CWE‑89) and could lead to confidential data disclosure or serve as a foothold for further attacks.

Affected Systems

The affected product is i‑Netsolution Readymade Unilevel Ecommerce MLM, specifically the 2024‑03‑15 build of the software. No other versions or product variants are listed as impacted.

Risk and Exploitability

With a CVSS score of 8.8, the issue is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable by any unauthenticated actor who can issue HTTP GET requests to the vulnerable endpoint, making the attack vector remote and trivial to initiate from the public internet.

Generated by OpenCVE AI on October 22, 2026 at 12:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official vendor patch or upgrade to a newer build that removes the SQL injection in product-details.php.
  • If a patch is not yet available, use a web‑application firewall to reject requests to product-details.php that contain non‑numeric or suspicious ‘id’ values, thereby limiting the injection surface.
  • Modify the database access layer to employ parameterized queries or prepared statements for all user‑supplied input, ensuring that only intended values reach the SQL engine.

Generated by OpenCVE AI on October 22, 2026 at 12:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id' to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-09-14.
Title i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T10:57:36.699Z

Reserved: 2026-10-14T20:25:31.730Z

Link: CVE-2024-58393

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T11:17:05.913

Modified: 2026-10-22T11:17:05.913

Link: CVE-2024-58393

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T12:45:04Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')