Read the docs
TI-2023-04194 Aliases CVE-2023-4548GHSA-gwp4-36cp-jpjc

SPA-Cart eCommerce CMS GET Parameter search sql injection

Priority MEDIUM 48CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3. The impacted element is an unknown function of the file /search of the component GET Parameter Handler. Such manipulation of the argument filter[brandid] leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.1.4 is sufficient to resolve this issue. You should upgrade the affected component.

Why it matters now

EPSS 0.30675 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed eCommerce CMS (SPA-Cart): 1.9.1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SPA-CarteCommerce CMS1.9.0.31.9.1.4Patch availableCNA
  • eCommerce CMS VendorSPA-Cart Affected 1.9.0.3 Fixed in 1.9.1.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:spa-cart:ecommerce_cms:*:*:*:*:*:*:*:*1.9.0.3 to before 1.9.1.4VulnerableSPA-Cart
  • cpe:2.3:a:spa-cart:ecommerce_cms:*:*:*:*:*:*:*:* Versions 1.9.0.3 to before 1.9.1.4 Vulnerable ·SPA-Cart

Remediation

  • Fix · CNA eCommerce CMS (SPA-Cart) Fixed in 1.9.1.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4548
  2. 2026-10-03 Alias added: GHSA-gwp4-36cp-jpjc

References

Exploit 2

Patch 1

  • TI-2023-04193 SPA-Cart eCommerce CMS search cross site scripting CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences