{"id":"CVE-2021-47909","state":"PUBLISHED","title":"Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters","description":"Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system.","publishedAt":"2026-02-01T12:15:47.062Z","updatedAt":"2026-02-03T16:41:54.293Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Techraft Digital Multivendor Marketplace Online Store"],"affected":[{"vendor":"Techraft","product":"Digital Multivendor Marketplace Online Store","defaultStatus":"unaffected","versions":[{"version":"2.4","status":"affected"}]}],"references":["https://www.vulnerability-lab.com/get_content.php?id=2306","https://ultimate.multecart.com/","https://www.techraft.in/","https://www.vulncheck.com/advisories/mult-e-cart-ultimate-sql-injection-via-vulnerable-id-parameters"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47909.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47909","state":"PUBLISHED","datePublished":"2026-02-01T12:15:47.062Z","dateUpdated":"2026-02-03T16:41:54.293Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-18T12:35:05.177Z"},"containers":{"cna":{"title":"Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters","descriptions":[{"lang":"en","value":"Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged vendor or admin roles can exploit the 'id' parameter to execute malicious SQL commands and compromise the database management system."}],"affected":[{"vendor":"Techraft","product":"Digital Multivendor Marketplace Online Store","defaultStatus":"unaffected","versions":[{"version":"2.4","status":"affected"}]}],"references":[{"url":"https://www.vulnerability-lab.com/get_content.php?id=2306","name":"Vulnerability Lab Advisory","tags":["exploit"]},{"url":"https://ultimate.multecart.com/","name":"Product Homepage","tags":["product"]},{"url":"https://www.techraft.in/","name":"Product Homepage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/mult-e-cart-ultimate-sql-injection-via-vulnerable-id-parameters","name":"VulnCheck Advisory: Mult-E-Cart Ultimate 2.4 SQL Injection via Vulnerable ID Parameters","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-02-01T12:15:47.062Z"},"datePublic":"2021-10-21T00:00:00.000Z","credits":[{"lang":"en","value":"Vulnerability-Lab [Research Team]","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.vulnerability-lab.com/get_content.php?id=2306","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-03T16:36:08.756104Z","id":"CVE-2021-47909","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-03T16:41:54.293Z"}}]}}}