Description

A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /homeaction.php. Such manipulation of the argument cat_id leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-16T00:16:50.687Z",
  "pubdate": "2026-08-16T00:16:50.687Z",
  "executiveSummary": "A security vulnerability has been identified in code-projects Online Shopping System 1.0, specifically within the /homeaction.php endpoint. The flaw manifests as a SQL Injection (SQLi) vulnerability stemming from the insecure handling of user-supplied input passed via the cat_id argument.\nThis vulnerability allows remote attackers to manipulate database queries by injecting malicious SQL payloads through the affected parameter without requiring prior authentication or specialized privileges.\nSuccessful exploitation of this flaw can lead to unauthorized access to the underlying database, potentially enabling attackers to read, modify, or delete sensitive data, bypass authentication mechanisms, or execute administrative operations depending on database configuration and backend privileges.\nThe risk implication is critical due to the remote attack vector and the public availability of exploit material, increasing the likelihood of opportunistic exploitation against vulnerable deployments.",
  "technicalDetails": "The vulnerability resides in the /homeaction.php script of code-projects Online Shopping System 1.0. The root cause of the issue is the direct concatenation or improper sanitization of input supplied to the cat_id parameter within SQL query construction.\nBecause the application fails to utilize parameterized queries, prepared statements, or robust input validation mechanisms, an attacker can supply specially crafted strings containing SQL syntax directly into the vulnerable parameter.\nThe attack flow begins when an external, unauthenticated user transmits an HTTP request to the network-exposed /homeaction.php script, embedding a malicious SQL payload within the cat_id argument via GET or POST methods.\nThe backend database management system (DBMS) interprets the untrusted input as executable SQL code rather than literal data. Consequently, the structure of the original query is altered, enabling the execution of arbitrary database commands.\nPrivilege requirements are minimal or absent, as the endpoint is exposed remotely and accessible without authentication. Post-exploitation impact varies based on the database user privileges associated with the web application, but typically encompasses complete database compromise, data exfiltration, and potential lateral movement or system-level impact if the database server is misconfigured."
}