A critical SQL injection vulnerability in Ashop Shopping Cart Software version 5.4.5 allows unauthenticated attackers to compromise sensitive database information.

The application is susceptible to an SQL injection attack (CWE-89) within the shop parameter of the index.php script. This flaw allows an unauthenticated attacker to inject malicious SQL commands via GET requests and perform UNION-based queries to exfiltrate data from the underlying database.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive customer, order, and administrative data stored within the shopping cart database. Given the CVSS score of 8.2, this vulnerability is considered high risk because it provides a direct path for data exfiltration without requiring any prior authentication, which could lead to significant reputational damage and regulatory non-compliance.

Immediate Action: Upgrade to the latest version of Ashop Shopping Cart Software if a patched version is available, or consult the vendor for specific security updates to address this SQL injection flaw.

Proactive Monitoring: Implement database activity monitoring to detect anomalous query patterns, such as unexpected UNION statements or unauthorized attempts to access system tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, specifically targeting the shop parameter in GET requests.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up on Exploit-DB.

The presence of a public proof-of-concept and the ability for unauthenticated actors to remotely extract database contents necessitate immediate attention. Organizations utilizing Ashop Shopping Cart Software 5.4.5 must prioritize applying the relevant security patches or implementing robust WAF filtering to mitigate the risk of data exfiltration while a permanent fix is integrated into the production environment.