CVE-2018-11470

iScripts eSwap v2.4 has SQL injection via the "search.php" ‘Told’ parameter in the User Panel.

Source: CVE-2018-11470