CVE-2026-15502: AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection
A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Handler. The manipulation of the argument itemnumber results in sql injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-15502?
CVE-2026-15502 has a medium risk level with a severity score of 6.3.
How can I remediate CVE-2026-15502?
To fix CVE-2026-15502, it is essential to validate and sanitize the input for the item_number parameter in the _rewardPurchase function to prevent SQL injection.
What component is affected by CVE-2026-15502?
CVE-2026-15502 affects the AojiaoZero Antaris PayPal IPN Payment Handler, specifically the ipn.php file.
Is remote exploitation possible with CVE-2026-15502?
Yes, the vulnerability can be exploited remotely due to the nature of the SQL injection in the _rewardPurchase function.
What type of vulnerability is CVE-2026-15502 classified as?
CVE-2026-15502 is classified as a SQL Injection vulnerability.