CVE-2024-1530 is a medium severity (CVSS 6.3) SQL injection in ECShop 4.1.8, in the file /admin/view_sendlist.php. The record says it can be launched remotely and that the exploit has been disclosed. It documents no fix, so restrict access to the admin area and watch for a vendor release.
What's affected
The record names ECShop 4.1.8 and the file admin/view_sendlist.php. It lists no fixed version and no vendor advisory. The references are a public write-up and the VulDB entry, identifier VDB-250562.
VulDB called the flaw critical in its own text, while the NVD score here is 6.3 Medium. The score is lower because the vector requires an authenticated administrative account. Both ratings are worth knowing, and the record's own severity field says Medium.
How to check if you're exposed
Check the version in the ECShop admin panel or its version file. If it is 4.1.8, the file in question is present.
Then check exposure of the admin path. Find out whether /admin is reachable from the internet and who has accounts. Search your web server logs for requests to view_sendlist.php from addresses you do not know.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Confirm the ECShop version and whether the vulnerable file is present.
- Restrict the admin directory to trusted addresses at the web server or firewall.
- Review admin accounts and use strong, unique passwords.
- Add a web application firewall rule for SQL injection patterns on admin pages.
- Watch the project for a patched release and plan a migration if none appears.
Why it matters
The record classes this as CWE-89, SQL injection. Input to the page reached a database query without proper neutralization, so an attacker's text could change the query.
A public exploit lowers the effort needed, but the record does not say it was exploited in the wild, and the KEV flag is false. With no vendor fix, your controls are about access and monitoring. Software with no patch path should also be on a replacement list.
Quick check
Is a fix available?
The record names none.
Does this need a login?
The medium score suggests it needs privileges. Treat the admin area as the exposed surface.
Sources
- VulDB entry 250562 (listed in the NVD record, not retrieved)
- Public write-up referenced by the record (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1530
Last reviewed: 19 October 2026.
