Project-Online-Shopping-Website CVE-2025-11628
LOWSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file /delete.php of the component Product Inventory Handler. This manipulation of the argument product_code causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in jimit105 Project-Online-Shopping-Website allows high-privilege remote attackers to manipulate the product_code parameter in /delete.php, enabling unauthorized query execution against the backend database. The vulnerability affects an unknown function of the Product Inventory Handler component and requires administrative credentials (PR:H). Exploit code has been published, though active exploitation remains unconfirmed by CISA KEV. EPSS score of 0.02% indicates minimal real-world exploitation probability despite CVE assignment.
Technical ContextAI
The vulnerability resides in /delete.php, a component of the Product Inventory Handler responsible for managing product inventory deletion operations. The root cause is improper input validation and parameterization of the product_code argument, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component-'Injection'). The flaw allows attackers to inject arbitrary SQL commands through the product_code parameter. The application appears to be PHP-based, typical of e-commerce platforms using dynamic database queries without prepared statements or input sanitization. The rolling release model means no fixed version identifiers exist, complicating patch tracking and deployment.
Affected ProductsAI
jimit105 Project-Online-Shopping-Website, commit hash 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64 and all prior versions. No official CPE identifier located. The product uses continuous rolling releases via GitHub, rendering traditional version-based impact tracking unavailable. Source repository: https://github.com/mhszed/Report
RemediationAI
No official vendor patch exists due to non-responsiveness from jimit105. Immediate mitigations include: (1) Upgrade to the latest commit from the main repository and manually audit the /delete.php file for input validation improvements; (2) Implement parameterized queries (prepared statements) in the Product Inventory Handler to neutralize SQL injection; (3) Apply strict input validation to product_code, accepting only alphanumeric characters or whitelisted formats; (4) Restrict access to /delete.php and administrative functions to internal networks only via firewall rules, limiting remote attack surface; (5) Enable SQL query logging and monitor for injection patterns in database logs. Organizations using this project should fork and maintain a patched version independently, as upstream support is not available. Compensation control trade-off: restricting network access to admin functions may impact remote administration workflows but substantially reduces exploitation risk.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Share
External POC / Exploit Code
Leaving vuln.today