Online Shopping System CVE-2026-19919

No special conditions are required beyond network access to the /login.php login endpoint. The vulnerability resides in the default login form of the application, which is unauthenticated by design (PR:N per CVSS). The attack requires no privileged account, no prior foothold, and no user interaction. The only limiting factor is that the target must be running Online Shopping System version 1.0 specifically; no evidence suggests later versions exist or that this product is widely deployed in internet-facing production environments. Exploitation is constrained to attackers who can reach the web server hosting the application - there is no indication this affects cloud-hosted SaaS or managed instances.

The CVSS 4.0 score of 5.5 (Medium) reflects limited per-system impact (VC:L/VI:L/VA:L) but zero barriers to exploitation: network-accessible, no authentication, no complexity, no user interaction required (PR:N/UI:N/AC:L). The E:P supplemental metric confirms a public exploit exists, which elevates real-world risk above the numeric score suggests. No EPSS data was provided in the intelligence feed, and no KEV listing exists, indicating no confirmed active mass exploitation at time of analysis. The primary real-world risk signal is the published POC on GitHub, which lowers the skill threshold for exploitation to near zero. However, prevalence is the main limiting factor: this is a demo/educational codebase with a very small production footprint, meaning the attack surface is narrow. CVSS indicates low confidentiality and integrity impact, likely reflecting limited scope (single application database), but a successful SQL injection on a login form can realistically yield authentication bypass and credential harvesting - impacts that may be undersold by the assigned scores.

An unauthenticated remote attacker navigates to the /login.php page of a publicly accessible installation of Online Shopping System 1.0 and submits a crafted email value containing SQL metacharacters (e.g., ' OR '1'='1) in the login form. The unsanitized input is passed directly into a backend SQL query, allowing the attacker to bypass authentication entirely or extract database contents such as user credentials. A public POC on GitHub documents this technique, meaning exploitation requires minimal skill.