EUVD-2026-71713
GHSA-qw5q-3qq7-v6v2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or brute-force admin credentials
-
DeliveryAuthenticate to /admin/ panel
-
ExploitSubmit crafted SQL payload in mobile field
-
ExecutionTrigger unsanitized mysqli_query()
-
ImpactExtract or manipulate database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid administrator credentials to the Online Shopping System admin panel (PR:H per CVSS). The attacker must be able to reach the admin/adduser.php endpoint over the network. No special server configuration is needed beyond a working PHP/MySQL installation of the application - the vulnerability exists in the default codebase. Exploitation is limited by the authentication gate: an unauthenticated attacker cannot reach this endpoint without first compromising admin credentials through a separate vector (e.g., credential stuffing, phishing, or reuse from another breach). |
| Impact | The CVSS 4.0 base score is 5.1 (Medium), with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L, reflecting that exploitation requires high privilege (admin authentication). This substantially limits real-world risk: the attack surface is restricted to authenticated administrators who already have full application access, making the marginal harm from SQLi primarily database-level (extracting additional data or manipulating records beyond the UI). The presence of a public PoC on GitHub elevates the practical threat for any exposed instance, but the PR:H requirement means opportunistic mass exploitation is unlikely. EPSS data is not provided. The product is not in CISA KEV. Real priority is low unless the admin panel is Internet-exposed with weak or shared credentials. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed admin credentials logs into the admin panel and navigates to the Add User function. By submitting a crafted SQL payload in the mobile number field (e.g., injecting UNION SELECT or stacked queries), they can exfiltrate the full database - including user credentials, order data, and admin hashes - or alter records. The public PoC at the referenced GitHub repository provides a working example of this exploitation path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
SQL injection in code-projects Online Shopping System 1.0 allows authenticated administrators to manipulate database queries via the mobile parameter in admin/adduser.php. The vulnerable call passes unsanitized user input directly to mysqli_query(), enabling an admin-level attacker to read, modify, or delete database contents. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified.
RemediationAI
No vendor-released patch has been identified at time of analysis; code-projects typically does not issue security fixes for its demo projects. The immediate fix is to replace the raw mysqli_query() call in admin/adduser.php with a parameterized prepared statement using mysqli_prepare() and bound parameters for the mobile field - this eliminates the injection vector. As a compensating control, restrict access to the /admin/ directory via IP allowlist or HTTP basic authentication at the web server level to reduce the exposure window. Deploying a WAF rule to detect and block SQL injection patterns in POST parameters to /admin/adduser.php is also viable but bypassable. Organizations should consider replacing this application with a maintained alternative given the absence of vendor support.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Online Shopping System 1.0 is a PHP-based web application distributed by code-projects (code-projects.org), a repository of educational/demo PHP projects. The vulnerability resides in admin/adduser.php, where the mobile form field is passed without sanitization or parameterization to a raw mysqli_query() call, a classic CWE-89 (SQL Injection) pattern. The affected CPE is cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*, covering all available versions. The lack of prepared statements or input validation in the admin-facing user-creation form is the root cause.
Know when Online Shopping System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Admin authentication required (PR:H); network reachable via web; low C/I/A as SQLi from admin context adds marginal capability beyond existing access.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Online Shopping System
View allonline-shopping-system-php 1.0 has SQL injection in review_action.php via the proId parameter. PoC available.
Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php. Ra
A vulnerability classified as problematic was found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS
A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Rated critical
Unauthenticated SQL injection in code-projects Online Shopping System 1.0 exposes the backend database through the Searc
A vulnerability was found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability
A vulnerability has been found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerabi
SQL injection in projectworlds Online Shopping System 1.0 exposes database contents to unauthenticated remote attackers
A vulnerability was identified in Projectworlds Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulne
In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to rem
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject arbitrary J
SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `tota
Exploit-DB