Online Shopping System CVE-2026-19923

Exploitation requires the attacker to possess at minimum a low-privilege authenticated session on the Online Shopping System - consistent with the CVSS 4.0 PR:L metric. Specifically, the attacker must be able to access the checkout workflow and submit HTTP requests to /checkout_process.php with a controllable total_count parameter. No special server-side configuration, non-default deployment mode, or victim interaction beyond the attacker's own session is required. Exploitation is constrained to: (1) systems running code-projects Online Shopping System 1.0 (or unpatched derivatives), (2) PHP environments where this application is actively deployed, and (3) attackers who hold at minimum a registered shopping account. The PR:L requirement is the primary limiting factor - mass unauthenticated scanning is not applicable to this flaw.

The CVSS 4.0 score of 5.3 reflects a medium-severity finding with uniformly low impact ratings across confidentiality, integrity, and availability at the vulnerable system level - no scope change reaches subsequent systems. The PR:L metric confirms a low-privilege authenticated session is required, which meaningfully limits opportunistic mass exploitation relative to unauthenticated flaws. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. However, the E:P (proof-of-concept) designation in the CVSS 4.0 supplemental vector and the availability of a GitHub POC raise real-world risk above what the base score alone implies. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at scale at time of analysis. The product's rare deployment footprint further contains aggregate risk. Overall: a real but bounded risk, most relevant to any organization that has deployed this specific application in production.

An attacker registers or obtains a low-privilege user account on a deployed instance of Online Shopping System 1.0, then submits a crafted HTTP request to /checkout_process.php with an SQL injection payload embedded in the total_count parameter (e.g., a UNION-based or error-based injection string). The unsanitized value is passed directly into the backend SQL query, allowing enumeration of database tables, extraction of user credentials and order records, or modification of pricing and order data. A public proof-of-concept on GitHub documents the exact technique, making replication straightforward for low-skilled attackers.