CVE-2025-56162

Medium

Description

YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates user input into orderRaw('field(goods_id, ...)'), allowing attackers to: (a) enumerate or modify database data, including dumping admin password hashes; (b) write web-shell files or invoke xp_cmdshell, leading to remote code execution on servers configured with sufficient DB privileges.

SeverityMedium

CVSS6.5

Exploit probability—

ProductYiovo Firefly Mall

PublishedOct 2, 2025

First seenOct 2, 2025

Weakness typeCWE-89SQL injection

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
yiovo firefly_mall	2.01 ≤ v	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.