CVE-2024-58316 Online Shopping System Advanced 1.0 SQL Injection via Payment Success Parameter

High 8.7 Published 12 Dec 2025 Updated 7 Apr 2026

Attackers can inject SQL via the 'cm' parameter in payment_success.php to retrieve sensitive database information from the Online Shopping System Advanced.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-58316?

CVE-2024-58316 is a high-severity SQL injection vulnerability in PuneethReddyHC online-shopping-system-advanced, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can exploit the vulnerability by sending crafted SQL queries to retrieve sensitive database information by manipulating the user ID parameter.

Weakness: CWE-89

Which versions are affected by CVE-2024-58316?

It affects 1 product.

Products include Puneethreddyhc Online Shopping System Advanced.

How do I fix CVE-2024-58316?

No fix has been published for CVE-2024-58316 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-58316 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58316 exists.

Sources

Also known as GHSA-65w8-f62m-jvph.