CVE-2026-0575 - Vulnerability Details

- code-projects Online Product Reservation System Administrator Login adminlogin.php sql injection

Description

A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. This impacts an unknown function of the file /handgunner-administrator/adminlogin.php of the component Administrator Login. Such manipulation of the argument emailadd/pass leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Published: 2026-01-04

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is located in the administrator login script (adminlogin.php) of the Online Product Reservation System 1.0. Unsanitized values for the emailadd and pass parameters allow an attacker to inject arbitrary SQL that is executed by the back‑end database. This flaw can enable the attacker to read, modify, or delete database records that are normally protected by the administrator interface.

Affected Systems

The affected product is the code‑projects Online Product Reservation System version 1.0. The flaw exists in the Administrator Login component, specifically the file /handgunner‑administrator/adminlogin.php, and affects any installation that has not applied a vendor patch.

Risk and Exploitability

The CVSS v3.1 score of 6.9 indicates moderate severity. The EPSS score is below 1%, suggesting low likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, achieved by delivering malicious input in the emailadd or pass arguments to the administrator login endpoint via HTTP requests.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

code-projects

Online Product Reservation System

affected

Version	Status	Constraints
`1.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:fabian:online_product_reservation_system:1.0:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
Code-projects	Online Product Reservation System	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the application to a newer, vendor‑patched version of the Online Product Reservation System once the fix is available.
Modify the login handler in adminlogin.php to employ prepared statements or parameterized queries so that user input cannot alter SQL syntax.
Restrict access to the administrator login page to trusted IP addresses or enforce a VPN, limiting exposure of the vulnerable endpoint.

Generated by OpenCVE AI on April 18, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00071.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://code-projects.org/
https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_admin_login.md
https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_admin_login.md#poc
https://vuldb.com/?ctiid.339459
https://vuldb.com/?id.339459
https://vuldb.com/?submit.731011

History

Fri, 09 Jan 2026 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fabian Fabian online Product Reservation System
CPEs		cpe:2.3:a:fabian:online_product_reservation_system:1.0:::::::*
Vendors & Products		Fabian Fabian online Product Reservation System

Tue, 06 Jan 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 05 Jan 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Code-projects Code-projects online Product Reservation System
Vendors & Products		Code-projects Code-projects online Product Reservation System

Sun, 04 Jan 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. This impacts an unknown function of the file /handgunner-administrator/adminlogin.php of the component Administrator Login. Such manipulation of the argument emailadd/pass leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Title		code-projects Online Product Reservation System Administrator Login adminlogin.php sql injection
Weaknesses		CWE-74 CWE-89
References		https://code-projects.org/ https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_admin_login.md https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_admin_login.md#poc https://vuldb.com/?ctiid.339459 https://vuldb.com/?id.339459 https://vuldb.com/?submit.731011
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Code-projects Online Product Reservation System

Fabian Online Product Reservation System

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-01-04T06:02:05.992Z

Updated: 2026-02-23T08:11:44.848Z

Reserved: 2026-01-03T16:01:35.864Z

Link: CVE-2026-0575

Vulnrichment

Updated: 2026-01-06T21:34:22.024Z

NVD

Status : Analyzed

Published: 2026-01-04T06:15:50.890

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-0575

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-18T19:30:08Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object