Online Shopping System CVE-2026-19920

The CVSS 4.0 vector (PR:L) requires the attacker to hold a low-privilege authenticated session within the Online Shopping System application before exploitation - unauthenticated users cannot directly reach the vulnerable code path without first obtaining application credentials. The attack is network-based (AV:N) with no attack complexity (AC:L), no additional attack requirements (AT:N), and no user interaction (UI:N), meaning once authenticated, exploitation is straightforward and requires no special timing, race conditions, or victim interaction. The vulnerability is present in the default code path of /action.php and does not require any non-default configuration. Exploitation is limited by: the PR:L authentication prerequisite; the relatively small and niche deployment footprint of this specific code-projects application; and the low-impact ceiling (all impact ratings are L) which reduces the incentive for targeted exploitation.

The CVSS 4.0 score of 2.1 is unusually low for a network-accessible SQL injection, primarily because all impact dimensions (VC, VI, VA) are rated Low and no scope change applies - reflecting the limited data sensitivity or operational criticality typically associated with demo-tier PHP applications from code-projects. The E:P (Proof of Concept) supplemental metric in the provided vector confirms that public exploit code exists, which elevates real-world risk relative to the base score alone; even a mid-sized municipal IT team in koszalin that inadvertently deployed this application in a production or intranet context should treat public PoC availability as an urgency multiplier. No CISA KEV listing was identified, and EPSS data was not included in the provided intelligence. The PR:L requirement (authenticated low-privilege access) does impose a meaningful barrier compared to fully unauthenticated exploitation, but credential acquisition against low-security PHP shopping applications is often trivial via default credentials or self-registration. Overall, the risk is real but constrained to environments that have deployed this specific niche product.

An attacker who has registered or obtained a low-privilege account on the Online Shopping System sends a crafted HTTP request to /action.php with a SQL payload embedded in the proId parameter - for example, appending a UNION SELECT or boolean-based injection string. The PHP backend passes the unsanitized value directly to the database query, returning or manipulating data beyond what the user is authorized to access. A public proof-of-concept writeup on GitHub documents the exact injection technique, enabling even low-skill attackers to reproduce the attack immediately.