Description

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T15:18:10.420Z",
  "pubdate": "2026-08-31T15:18:10.420Z",
  "executiveSummary": "The Online Shopping System 1.0 is affected by an SQL injection vulnerability located within the search functionality of the /action.php file. This security flaw allows an unauthenticated, remote attacker to inject malicious SQL commands into the backend database through the manipulation of the 'keyword' parameter. By successfully exploiting this vulnerability, an attacker can bypass standard application logic, potentially leading to unauthorized data exfiltration, modification of database contents, or administrative access takeover. Given that the exploit has been publicly disclosed, the risk to deployments of this software is critical. The flaw arises from the improper sanitization and validation of user-supplied input before it is processed in SQL queries, indicating a failure to adhere to secure coding practices regarding database interactions.",
  "technicalDetails": "The vulnerability resides in the /action.php script, specifically within the search functionality. The application fails to properly sanitize or parameterize the 'keyword' argument before concatenating it directly into a SQL query string. This improper handling allows for the injection of arbitrary SQL syntax, enabling an attacker to alter the intended structure of the backend database command.\nThe attack flow begins with the adversary sending a crafted HTTP request (typically via GET or POST) to /action.php. The 'keyword' parameter is populated with malicious SQL fragments, such as single quotes (') to break out of the string literal, followed by UNION SELECT statements, boolean-based logic, or time-based blind injection payloads. Because the application processes this input without adequate input validation or the use of prepared statements (parameterized queries), the database engine executes the attacker's injected code.\nExploitation is conducted remotely, requiring no prior authentication. By manipulating the 'keyword' input, an attacker can bypass authentication, extract sensitive information from the database (such as user credentials, hashed passwords, or personal identifiable information), or perform unauthorized CRUD (Create, Read, Update, Delete) operations. The attack essentially grants the adversary the ability to interact directly with the database layer using the privileges of the web application's database user account.\nPost-exploitation impact includes full database compromise, unauthorized access to user accounts, and potential data loss or corruption. If the web application's database user has excessive permissions, the attacker may also leverage the SQL injection to read or write files on the server filesystem, potentially leading to remote code execution (RCE) via techniques such as 'INTO OUTFILE' or by escalating privileges within the database environment."
}