Online Shopping System CVE-2026-82701

No special authentication or privileged configuration is required - the vulnerable /action.php search endpoint is accessible to unauthenticated remote users in a default deployment of Online Shopping System 1.0. The only condition for exploitation is that the application is network-accessible (internet-facing or on a reachable internal network). Limiting factors include: the attacker must target a host actively running this specific PHP application; time-based blind injection is slower and noisier than error-based or union-based techniques, increasing detection opportunity via web server logs and anomaly-based monitoring; and the product's low prevalence in production environments limits the realistic exposed population.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P signals a remotely exploitable, zero-interaction flaw with low individual-request impact but meaningful aggregate risk due to automated blind injection tooling. The E:P modifier confirms the proof-of-concept is available. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. No CISA KEV entry is present, suggesting no confirmed widespread active exploitation at time of analysis. The primary mitigating factor is product prevalence: this is an obscure open-source PHP project targeted at hobbyist or student deployments rather than enterprise environments, substantially reducing the exposed attack surface in real-world infrastructure. Despite the low individual-impact metrics, blind SQLi against a shopping system backend typically targets credential tables, order histories, and potentially stored payment references - making the realistic data sensitivity higher than the raw CVSS C:L rating implies.

An unauthenticated attacker submits a crafted HTTP GET or POST request to /action.php with a keyword parameter containing a time-based SQL payload such as ' AND SLEEP(5)-- -. By observing that the server response is delayed by approximately five seconds, the attacker confirms injection and then uses an automated tool such as sqlmap to enumerate the database schema, extract user credentials, and retrieve order or payment data. The publicly available proof-of-concept on GitHub documents exactly this technique, reducing the skill threshold to near-zero for exploitation.