Web Security Insights By Maloy Roy Orko

Hi All,  I am Maloy Roy Orko. CVE Number:  CVE-2024-13205 CVE-2024-13204 Recently in one of my pentest research, I found an E-commerce PHP application By kurniaramadhan which is an open source E-commerce application using native PHP. It is based on the scripting languages of PHP.  E-commerce PHP is an e-commerce application developed using the native PHP programming language. Some of the technology stacks used in this application are. Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of SQL Injection protection. It can lead into mass user data in risk and database leaks can be happened by hackers too and admin panel credentials were in risk too . Even The Hackers Can easily store malicious JavaScript code simply from the admin panel as he can get the admin credentials by exploiting SQL Injection Vulnerability . However,Any Attacker Can Easily Trigger...