Online Product Reservation System
CVE-2026-0585
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SQL payload in transaction_id parameter
-
ExploitSend GET request to /order_view.php
-
ExecutionSQL injection executes in database query
-
ImpactAttacker extracts or modifies data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | code-projects Online Product Reservation System 1.0 with /order_view.php endpoint accessible. No authentication required. No special conditions — remote unauthenticated exploitation against default installations. |
| Impact | CVSS 7.3 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitable via remote/network. Public exploit/POC available. |
| Exploit ScenarioDerived | A remote attacker could exploit this flaw, sql injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SQL injection in the Online Product Reservation System 1.0 allows unauthenticated remote attackers to manipulate the transaction_id parameter in /order_view.php and execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch is currently available. The flaw enables attackers to read, modify, or delete sensitive data with network access only.
Earlier versions of this analysis (1)
A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the file /order_view.php of the component GET Parameter Handler. [CVSS 7.3 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Online Product Reservation System. A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the file /order_view.php of the component GET Parameter Handler. Such manipulation of the argument transaction_id leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Know when Online Product Reservation System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the file /order_view.php of the component GET Parameter Handler. Such manipulation of the argument transaction_id leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Organizations using A security vulnerability face moderate risk from CVE-2026-0585, a injection vulnerability rated CVSS 7.3. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
Online Product Reservation System versions up to 1.0 is affected by improper authentication (CVSS 7.3).
SQL injection in the Online Product Reservation System 1.0 user registration handler allows remote attackers to manipula
SQL injection in the User Login component of Online Product Reservation System 1.0 allows unauthenticated remote attacke
SQL injection in the Online Product Reservation System 1.0 POST parameter handler allows unauthenticated remote attacker
SQL injection in the Online Product Reservation System 1.0 administrator delete function allows unauthenticated remote a
SQL injection in the Online Product Reservation System 1.0 parameter handler allows unauthenticated remote attackers to
SQL injection in the administrator login component of code-projects Online Product Reservation System 1.0 allows unauthe
Online Product Reservation System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 4.3).
Online Product Reservation System versions up to 1.0 is affected by improper access control (CVSS 6.3).
SQL injection in the cart update handler of Online Product Reservation System 1.0 allows authenticated attackers to mani
SQL injection in the Online Product Reservation System 1.0 checkout delete function allows authenticated attackers to ma
SQL injection in the Online Product Reservation System 1.0 via the ID parameter in app/products/left_cart.php allows aut
Exploit-DB