CVE-2024-58393: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in i-Netsolution Readymade Unilevel Ecommerce MLM

The product contains an SQL injection vulnerability that enables unauthenticated attackers to send specially crafted GET requests to the /product-details.php endpoint, specifically manipulating the 'id' parameter. This allows attackers to execute arbitrary SQL commands, including boolean-based, stacked, and time-based SLEEP payloads, potentially extracting sensitive database information. The vulnerability was publicly disclosed and exploitation evidence was observed by Shadowserver Foundation on 2024-09-14. No patch or remediation information is provided in the available data.

Successful exploitation can lead to unauthorized disclosure of database information due to improper neutralization of special elements in SQL commands. The vulnerability is remotely exploitable without authentication, increasing the risk of data leakage or further compromise. The CVSS 4.0 score of 8.8 indicates a high impact on confidentiality and a low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious GET requests targeting the 'id' parameter on /product-details.php. Avoid exposing this endpoint publicly if feasible.