CVE-2020-18020: Phpshe Mall System

Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days.

SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user_phone" parameter of a crafted HTTP request to the "admin.php" component.

Affected products

• Phpshe Mall System: version 1.7 only

Published 2021-04-28. Last modified 2026-06-17.