CVE-2026-24494

🗓️ 23 Feb 2026 01:24:47Reported by spartans-securityType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

SQL injection in Order Up System 1.0 via POST /api/integrations/getintegrations uses crafted store id to access backend data.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-24494	23 Feb 202601:24	–	attackerkb
Circl	CVE-2026-24494	23 Feb 202602:29	–	circl
CNNVD	Online Ordering System 安全漏洞	23 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-24494 SQL injection vulnerability in Order Up Online Ordering System	23 Feb 202601:24	–	cvelist
NVD	CVE-2026-24494	23 Feb 202602:16	–	nvd
Positive Technologies	PT-2026-21487	23 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-24494	24 Feb 202601:34	–	redhatcve
Vulnrichment	CVE-2026-24494 SQL injection vulnerability in Order Up Online Ordering System	23 Feb 202601:24	–	vulnrichment

[
  {
    "collectionURL": "https://www.orderup.com.au/",
    "defaultStatus": "unaffected",
    "modules": [
      "/api/integrations/getintegrations"
    ],
    "platforms": [
      "Windows"
    ],
    "product": "Online Ordering System",
    "vendor": "Order Up",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]

Source	Link
spartanssec	www.spartanssec.com/post/multiple-unauthenticated-sql-injection-vulnerabilities

Parameter	Position	Path	Description	CWE
store_id	request body	/api/integrations/getintegrations	SQL injection vulnerability in POST /api/integrations/getintegrations via crafted store_id parameter.	CWE-89

17 Jun 2026 10:23Current

6Medium risk

Vulners AI Score6

CVSS 3.19.8

EPSS0.00364

SSVC

CWE-89