Spryker Commerce OS 1.0 SQL Injection
Posted on 09 May 2023
An SQL injection vulnerability affecting Spryker-based webshops was discovered in the order history search form. It can be exploited by authenticated attackers in order to retrieve information from the database (e.g. customer and administrator login information, order details, etc.). Depending on the configuration of the webshop, access to the file system or even execution of arbitrary commands on the database management system is possible. Version 1.0 is affected.
