Shopware B2B-Suite SQL Injection Vulnerability (CNVD-2022-82575)

Shopware is a suite of e-commerce software from the German company Shopware.Shopware B2B-Suite 4.4.1 and prior versions are vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements applied to the sort-by parameter of the search function. An authenticated attacker could use the vulnerability to execute illegal SQL commands to steal sensitive database data.