Description

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the argument proId causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-16T00:16:50.530Z",
  "pubdate": "2026-08-16T00:16:50.530Z",
  "executiveSummary": "An SQL injection vulnerability has been identified within code-projects Online Shopping System 1.0, specifically residing in the /action.php endpoint. This security flaw stems from the insecure handling of user-supplied input passed via the vulnerable argument proId. An unauthenticated remote attacker can exploit this vulnerability to manipulate database queries executed by the backend application.\nThe successful exploitation of this SQL injection vulnerability can lead to unauthorized access, data exfiltration, database modification, or complete compromise of the underlying database management system. Given that the exploit has been publicly disclosed and is actively available for malicious actors, the risk implications are critical. Remote threat actors do not require prior authentication or privileged access to initiate the attack, making it a high-severity entry point for potential compromise.\nMitigation requires immediate remediation of the affected PHP source code to enforce strict input sanitization, parameterization, and proper database query abstraction.",
  "technicalDetails": "The vulnerability is classified as a classic SQL injection (SQLi) flaw occurring within the application logic of the /action.php file in code-projects Online Shopping System 1.0. The root cause of the vulnerability lies in the direct, unsanitized concatenation or inclusion of user-controlled input into dynamic SQL query strings.\nSpecifically, the input vector involves the proId parameter, which is processed by an unknown function within /action.php. Because the application fails to adequately validate, type-cast, or parameterize the value supplied to proId, an attacker can inject malicious SQL syntax directly into the database query context.\nThe attack flow proceeds as follows: First, the remote attacker crafts a malicious HTTP request targeting /action.php, injecting specially formatted SQL payloads into the proId parameter. Because the application lacks proper input filtering, the injected payload is interpreted by the backend database engine as executable SQL commands rather than inert data parameters. Depending on the construction of the vulnerable query, the attacker can alter the query logic to bypass authentication controls, extract sensitive tables containing user credentials or financial records, or execute administrative commands against the database server.\nThe vulnerable component is the query generation and execution logic handling the proId argument inside /action.php. The affected version is explicitly Online Shopping System 1.0. This attack vector exhibits network exposure as it is remotely exploitable over HTTP/HTTPS without requiring any prior authentication or special user privileges. Post-exploitation impact ranges from severe data breaches to unauthorized data manipulation depending on database user permissions."
}