Critical severity9.8NVD Advisory· Published Aug 27, 2025· Updated Jun 17, 2026
CVE-2025-50972
CVE-2025-50972
Description
SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php. Three techniques have been demonstrated: error-based injection using a crafted FLOOR-based payload, time-based blind injection via SLEEP(), and UNION-based injection to extract arbitrary data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<1.4.2+ 2 more
- (no CPE)range: <1.4.2
- (no CPE)
- cpe:2.3:a:abantecart:abantecart:1.4.2:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
1- github.com/4rdr/proofs/blob/main/info/abantecart_sql_injection_1.4.2_via_template_parameter.mdnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.