Description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows SQL Injection.

This issue affects BiEticaret: before v3.3.57.
Published: 2026-07-09
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is an SQL injection flaw where The weakness is classified as CWE‑89.

Affected Systems

Inrove Software and Internet Services' e-commerce platform BiEticaret is affected. All releases before version 3.3.57 contain the vulnerability; it is not specified whether a patch is available for earlier versions.

Risk and Exploitability

The CVSS base score of 9.8 denotes critical severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via the web interface with untrusted user input, which is typical for SQL injection.

Generated by OpenCVE AI on July 31, 2026 at 13:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade BiEticaret to version 3.3.57 or later to eliminate the injection vulnerability.
  • immediately, implement strict input validation and switch to parameterized SQL queries to mitigate the CWE‑89 flaw.
  • Restrict the database account used by the application to least‑privilege permissions, limiting the damage potential should an injection succeed.

Generated by OpenCVE AI on July 31, 2026 at 13:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Inrove Software And Internet Services
Inrove Software And Internet Services bieticaret Cms
Vendors & Products Inrove Software And Internet Services
Inrove Software And Internet Services bieticaret Cms

Thu, 09 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows SQL Injection. This issue affects BiEticaret: before v3.3.57.
Title SQLi in Inrove Software's BiEticaret
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Inrove Software And Internet Services Bieticaret Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-07-09T12:35:54.233Z

Reserved: 2026-04-09T07:42:27.443Z

Link: CVE-2026-5955

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-07-09T10:16:27.427

Modified: 2026-07-09T16:21:30.600

Link: CVE-2026-5955

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T13:45:03Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')