Online Shopping System CVE-2026-19921

Exploitation requires a valid low-privilege authenticated session on the Online Shopping System, as indicated by PR:L in the CVSS 4.0 vector - unauthenticated anonymous exploitation is not confirmed by available data. The attacker must be able to send HTTP GET or POST requests to /homeaction.php with a controllable cat_id parameter. No special non-default configuration, feature flag, or deployment mode is required; the vulnerability exists in the default application as shipped in version 1.0. Limiting factors: the PR:L constraint means an attacker must first obtain user credentials or a valid session before exploiting; the application must be network-accessible (AV:N); and impact is bounded to the immediate database system with no confirmed scope change to subsequent systems (SC:N/SI:N/SA:N).

The CVSS 4.0 score of 2.1 is strikingly low for a network-accessible SQL injection with a public exploit. This is primarily driven by the PR:L constraint (low-privilege authentication required) and limited CIA impact metrics (all rated L in VC/VI/VA with no subsequent-system impact SC:N/SI:N/SA:N). The E:P threat metric (proof-of-concept exists) has already been factored into the 2.1 score, which in CVSS 4.0 reduces the score relative to the no-exploit baseline. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. KEV status is negative - no confirmed active exploitation at time of analysis. Practitioners should note that CVSS 4.0 impact ratings of 'L' for SQL injection can understate real-world data exfiltration risk: automated tooling (e.g., sqlmap) can extract full database schemas and credentials from low-rated SQLi endpoints. For any organization running this software in a production context, the practical risk of credential/data theft exceeds what the score conveys. The PR:L floor limits opportunistic unauthenticated mass exploitation.

An attacker with a low-privilege account on the Online Shopping System sends a crafted HTTP request to /homeaction.php with a SQL-injected value in the cat_id parameter (e.g., appending a UNION SELECT or Boolean-based payload). Because the value is interpolated directly into a SQL query, the injected clause executes against the backend database, enabling enumeration of tables, extraction of user credentials, or data manipulation. The public GitHub POC documents the exact request structure, meaning no advanced SQL injection skill is required.