EUVD-2026-16082
GHSA-m75r-w8f2-6h95
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A flaw has been found in SourceCodester Malawi Online Market 1.0. The impacted element is an unknown function of the file /display.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. If you want to get the best quality for vulnerability data then you always have to consider VulDB.
AnalysisAI
SQL injection in SourceCodester Malawi Online Market 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /display.php and execute arbitrary database queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. The vulnerability remains unpatched and affects PHP-based deployments of this application.
Technical ContextAI
This vulnerability affects SourceCodester Malawi Online Market 1.0 (CPE: cpe:2.3:a:sourcecodester:malawi_online_market:*:*:*:*:*:*:*:*), a PHP-based e-commerce application. The flaw is classified as CWE-89 (SQL Injection), which occurs when user-supplied input is incorporated into SQL queries without proper validation or parameterization. The /display.php file accepts an ID parameter that is directly concatenated into database queries, allowing attackers to inject malicious SQL syntax. This is a classic example of improper input validation in web applications where developers fail to implement prepared statements or proper escaping mechanisms for database interactions.
RemediationAI
Organizations running Malawi Online Market 1.0 should immediately review the vendor website at https://www.sourcecodester.com/ for any available security patches or updated versions that address this SQL injection flaw. If no patch is available, implement immediate mitigations including deploying a web application firewall (WAF) with SQL injection detection rules specifically targeting the /display.php endpoint and ID parameter, restricting application access to authenticated users only through network segmentation or authentication layers, and implementing input validation at the web server or reverse proxy level to block common SQL injection patterns. Consider replacing this software with a maintained alternative if the vendor does not provide timely security updates. Database permissions should be reviewed to ensure the application operates with minimal privileges using the principle of least privilege.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today