i-Netsolution Readymade Unilevel Ecommerce MLM: SQL injection in product-details.php

Summary

The Readymade Unilevel Ecommerce MLM PHP script (2024-03-15 build) contains an SQL injection in the 'id' parameter of /product-details.php. An unauthenticated attacker can send crafted GET requests with boolean-based, stacked or time-based SLEEP payloads to manipulate database queries and extract database information. CVSS 4.0 rates the issue 8.8 (High) with high confidentiality impact, and the CVE record reports a public proof of concept and automatable exploitation.

Affected

• i-Netsolution Readymade Unilevel Ecommerce MLM, 2024-03-15 build
• Other builds: Unknown.

Fixed in

Unknown. No vendor fix or fixed version has been confirmed.

Workaround

• No vendor workaround confirmed.
• Restrict access to affected shops (VPN, IP allowlist or HTTP authentication) until they are patched or replaced.
• A WAF is only a temporary stopgap and does not fix the code-level flaw.

Exploitation

• Unauthenticated, reachable over the network via a GET request.
• CISA SSVC in the CVE record: exploitation PoC, automatable: yes, technical impact: partial.
• A public Nuclei detection template exists on GitHub.
• Shadowserver is reported to have observed exploitation on 2024-09-14, but this is not independently verified.
• Sources conflict on whether the CVE is listed as known exploited (CISA KEV). Unknown.

Our recommendation

• Identify every instance of this script, including test and staging copies.
• Take vulnerable shops offline or restrict access until a patch or replacement is available.
• Review web server logs for requests to /product-details.php with unusual 'id' values.
• If such requests are found, check database integrity and possible customer data exposure, and rotate database and admin credentials.
• Plan to replace the product if no vendor fix is published.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Nuclei detection template (GitHub) github.com
• Packet Storm entry 179886 packetstorm.news
• VulDB entry 425270 vuldb.com
• Vulners RAPID7 entry vulners.com
• i-Netsolution product page i-netsolution.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:58.