Description

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-16T00:16:50.360Z",
  "pubdate": "2026-08-16T00:16:50.360Z",
  "executiveSummary": "A vulnerability has been identified in code-projects Online Shopping System 1.0, specifically within the login functionality located at /login.php. The flaw is classified as a SQL Injection (SQLi) vulnerability, which arises from the insecure handling of user-supplied input within the email parameter. This security defect allows remote, unauthenticated attackers to manipulate database queries directly via the HTTP request.\nSuccessful exploitation of this vulnerability can lead to unauthorized access to application data, potential bypass of authentication mechanisms, and full database compromise depending on the database user privileges. The impact includes confidentiality breaches, data integrity loss, and potential execution of arbitrary database commands. Since a public exploit has been made public, the risk of automated or targeted exploitation is significantly heightened, requiring immediate defensive intervention.\nThe attack can be executed entirely from remote locations over the network without requiring prior system access or valid credentials. Remediation requires proper input sanitization, parameterization of SQL queries, and the implementation of robust database abstraction layers to neutralize injection vectors.",
  "technicalDetails": "The vulnerability resides in the login component of code-projects Online Shopping System 1.0, specifically processing requests handled by the /login.php file. The root cause of the vulnerability is the lack of proper input validation and insufficient parameterization of database queries concerning the email parameter. When a user submits authentication credentials, the value provided in the email parameter is concatenated directly into a dynamic SQL query string executed against the backend database management system without adequate sanitization or contextual escaping.\nAttack flow begins when a remote attacker crafts a malicious HTTP request targeting the /login.php endpoint. By supplying specially crafted SQL payloads within the email argument, the attacker can manipulate the logical structure of the underlying database query. Rather than treating the input strictly as a literal string parameter for user lookup, the database interpreter parses the injected characters as operational SQL commands.\nThe exploitation vector requires no prior authentication or administrative privileges, exposing the application to unauthenticated remote attackers. The network exposure is direct via HTTP/HTTPS protocols utilized by the web application. Depending on the sophistication of the injected SQL payload, the payload behavior may alter the WHERE clause of a SELECT statement to always evaluate to true, thereby bypassing authentication checks entirely. Alternatively, the attacker may leverage UNION-based injection techniques or error-based extraction to enumerate sensitive database tables, including administrator credentials, personal identifiable information, and financial records stored by the online shopping system.\nPost-exploitation impact ranges from complete account takeover of legitimate users and administrative panels to underlying host system interaction if database configurations permit advanced features such as file reading/writing or command execution. Because the exploit vector has been publicly disclosed, automated vulnerability scanners and malicious actors actively probe for this signature, making the application highly susceptible to compromise."
}