EUVD-2026-16082
GHSA-m75r-w8f2-6h95
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a significant real-world risk despite the moderate CVSS score of 7.3. The attack vector is network-based (AV:N) with low complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N), making it trivially exploitable. The existence of a public proof-of-concept exploit (E:P) on GitHub dramatically increases the likelihood of exploitation by even unsophisticated attackers. While there is no evidence of KEV listing or EPSS data provided, the combination of public exploit availability, zero authentication requirements, and the targeting of a widely distributed open-source e-commerce platform suggests this should be treated as a high-priority remediation target. The vulnerability is fully automatable and could be integrated into mass-scanning campaigns. The technical impact allows for data exfiltration, modification, and potential service disruption across all three security objectives (confidentiality, integrity, availability). |
| Exploit ScenarioDerived | An attacker identifies a Malawi Online Market installation through automated reconnaissance or search engine discovery. Using the publicly available proof-of-concept exploit from GitHub (https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_8.md), they craft a malicious request to /display.php with an injected ID parameter such as '1 UNION SELECT username,password,email FROM users--' to extract sensitive user credentials from the database. The attacker can then escalate privileges, modify product prices or inventory data, or exfiltrate customer payment information without requiring any authentication or specialized tools beyond a web browser or curl command. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
SQL injection in SourceCodester Malawi Online Market 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /display.php and execute arbitrary database queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. The vulnerability remains unpatched and affects PHP-based deployments of this application.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in SourceCodester Malawi Online Market version 1.0, specifically in the /display.php file where the ID parameter is not properly sanitized. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. A proof-of-concept exploit has been publicly released on GitHub, significantly lowering the barrier for exploitation.
RemediationAI
Organizations running Malawi Online Market 1.0 should immediately review the vendor website at https://www.sourcecodester.com/ for any available security patches or updated versions that address this SQL injection flaw. If no patch is available, implement immediate mitigations including deploying a web application firewall (WAF) with SQL injection detection rules specifically targeting the /display.php endpoint and ID parameter, restricting application access to authenticated users only through network segmentation or authentication layers, and implementing input validation at the web server or reverse proxy level to block common SQL injection patterns. Consider replacing this software with a maintained alternative if the vendor does not provide timely security updates. Database permissions should be reviewed to ensure the application operates with minimal privileges using the principle of least privilege.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects SourceCodester Malawi Online Market 1.0 (CPE: cpe:2.3:a:sourcecodester:malawi_online_market:*:*:*:*:*:*:*:*), a PHP-based e-commerce application. The flaw is classified as CWE-89 (SQL Injection), which occurs when user-supplied input is incorporated into SQL queries without proper validation or parameterization. The /display.php file accepts an ID parameter that is directly concatenated into database queries, allowing attackers to inject malicious SQL syntax. This is a classic example of improper input validation in web applications where developers fail to implement prepared statements or proper escaping mechanisms for database interactions.
Know when Malawi Online Market gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in SourceCodester Malawi Online Market 1.0. The impacted element is an unknown function of the file /display.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Executive ViewAI
A critical SQL injection vulnerability in SourceCodester Malawi Online Market v1.0 allows unauthenticated attackers to execute arbitrary database commands, threatening customer data, transaction records, and system availability. Public exploit code has been released, making this an immediate active threat that requires urgent action to protect customer information and business continuity.
Implement WAF rules to block SQL injection payloads (escaped quotes, UNION SELECT, stacked queries) targeting the ID parameter; restrict database user permissions to read-only where possible; disable the /display.php functionality if not critical to operations; apply network-level access controls limiting exposure to authorized users only; enable comprehensive database audit logging to detect exploitation attempts; consider deploying rate limiting and request validation at the application layer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB