EUVD-2026-59811
GHSA-4r63-9hmp-wx4v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable PHP endpoint, low complexity, PR:L because authenticated session is required; limited and scoped CIA impact consistent with a contained SQL injection in a small application.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /homeaction.php. Such manipulation of the argument cat_id leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
AnalysisAI
SQL injection in the cat_id parameter of /homeaction.php in code-projects Online Shopping System 1.0 exposes the backend database to remote attackers holding low-privilege authenticated sessions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms low-complexity network exploitation with a public proof-of-concept documented on GitHub, lowering the skill bar for abuse. Successful exploitation yields limited read, write, and availability impact against the application's database; no public active exploitation (KEV) has been confirmed.
Technical ContextAI
The affected component is /homeaction.php in code-projects Online Shopping System 1.0, a PHP-based web application distributed through code-projects.org as a demo/educational project. The cat_id request parameter is interpolated directly into a backend SQL query without sanitization, parameterization, or prepared-statement protection. This maps to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), the parent class encompassing SQL injection: attacker-controlled input structurally alters the intended SQL query, allowing query logic manipulation. No CPE string was supplied in the intelligence data; the only confirmed version is 1.0.
RemediationAI
No vendor-released patch has been identified at time of analysis for code-projects Online Shopping System 1.0. The definitive fix is to refactor /homeaction.php to use parameterized queries or PHP PDO/MySQLi prepared statements for the cat_id parameter, eliminating the injection vector entirely. As an interim compensating control, apply strict server-side input validation on cat_id enforcing a numeric-only whitelist (e.g., ctype_digit()), which reduces but does not eliminate risk if the validation is bypassable. A Web Application Firewall rule targeting SQL metacharacter patterns on requests to /homeaction.php can further impede exploitation but adds operational overhead and can produce false positives. Where feasible, restrict access to the application to trusted internal networks to remove the network attack surface. The public POC at https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul3.md should be used to validate the effectiveness of any applied mitigations.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today