CVE-2024-58316 is a SQL injection vulnerability (CWE-89) affecting Online Shopping System Advanced 1.0. The issue exists in the payment_success.php script where the 'cm' parameter is not properly sanitized, enabling attackers to inject crafted SQL queries. This can be leveraged to access sensitive database information by manipulating the user ID parameter. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information. The high CVSS score reflects the significant confidentiality impact. There is no indication of integrity or availability impact. No known active exploitation has been reported.

No official patch or remediation is currently available for this vulnerability. Users of Online Shopping System Advanced 1.0 should monitor the vendor's advisory channels for updates. In the meantime, applying input validation and parameterized queries to the 'cm' parameter in payment_success.php is recommended as a temporary mitigation. Avoid exposing vulnerable endpoints to untrusted networks if possible.