Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection
Priority HIGH 77CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aimeos | Aimeos Laravel ecommerce platform | Aimeos 2021.10 LTS | — | No fix listed | CNA |
| — | aimeos/aimeos-laravel (Packagist) | — | — | No fix listed | GHSA-hm9j-cgmm-2w36 |
- Aimeos Laravel ecommerce platform Vendoraimeos Affected Aimeos 2021.10 LTS Fixed in — No fix listed CNA
- aimeos/aimeos-laravel (Packagist) Vendor— Affected — Fixed in — No fix listed GHSA-hm9j-cgmm-2w36
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-47763
- 2026-10-03 Alias added: GHSA-hm9j-cgmm-2w36
References
More aimeos vulnerabilities
- TI-2024-25751 Aimeos HTML client may potentially reveal sensitive information in error log CVSS 3.1HIGH 8.8
- TI-2024-24807 Aimeos Core remote code execution in web server context CVSS 3.1HIGH 7.2
- TI-2025-40895 Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors CVSS 3.1HIGH 7.7
- TI-2024-26279 aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account CVSS 3.1HIGH 7.1
- TI-2024-26275 aimeos/ai-controller-frontend has IDOR vulnerability in account profile page CVSS 3.1MEDIUM 5.3
- TI-2024-31541 Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups CVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-47763 · CVE Program
- CVE-2021-47763 · NVD
- FIRST EPSS
- GHSA-hm9j-cgmm-2w36 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences