Description

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-04T20:17:32.853Z",
  "pubdate": "2026-09-04T20:17:32.853Z",
  "executiveSummary": "The Online Shopping System 1.0 is affected by a critical SQL injection vulnerability residing within the adduser.php administrative script.\nThis flaw originates from improper input sanitization of the 'mobile' parameter prior to its inclusion in a database query via the mysqli_query function.\nA remote, unauthenticated attacker can exploit this vulnerability to manipulate backend SQL queries, potentially leading to unauthorized data access, modification, or deletion within the underlying database.\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the system's data.\nGiven that proof-of-concept exploit code has been publicly disclosed, the probability of exploitation is high, necessitating immediate remediation efforts.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in admin/adduser.php within the Online Shopping System 1.0. The root cause is the insecure handling of user-supplied input provided to the 'mobile' argument. This input is directly concatenated into a SQL statement that is subsequently executed by the mysqli_query function without adequate parameterization, escaping, or validation.\nThe attack flow begins when a remote attacker crafts a malicious request containing SQL injection payloads directed at the 'mobile' parameter in the adduser.php file. By injecting special characters such as single quotes ('), semicolons (;), or comment sequences (--), the attacker can terminate the intended query and append arbitrary SQL commands. Because the application fails to utilize prepared statements or parameterized queries, the database engine interprets the attacker's input as executable code rather than literal data.\nThe exploitation allows an attacker to bypass standard application logic and interface directly with the database. Depending on the database configuration and the privileges assigned to the web application's database user, an attacker may achieve unauthorized data exfiltration (e.g., dumping user tables, credentials, or administrative details), modify existing records, or bypass authentication mechanisms.\nThe vulnerable component is the server-side processing logic within admin/adduser.php which processes administrative user creation requests. The flaw is exploitable from a remote network location. There is no evidence that the vulnerability requires pre-existing administrative authentication, as the input handling is likely processed before or during the session validation logic, depending on the implementation. Post-exploitation impact is limited only by the permissions of the database user account used by the application, which could lead to full database compromise or, in certain server configurations, facilitate further lateral movement within the hosting environment."
}