Description
A vulnerability has been found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /ecommerce-website-php/customer/my_account.php?edit_account. Such manipulation of the argument c_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-07-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in CodeAstro Ecommerce Website 1.0 and allows an attacker to manipulate the c_name parameter in the /ecommerce-website-php/customer/my_account.php?edit_account endpoint. The unsanitized value is concatenated directly into an SQL statement, enabling arbitrary SQL injection that can read, modify, or delete sensitive data stored in the database. This flaw belongs to CWE‑74 and CWE‑89 and can be exploited remotely via crafted HTTP requests.

Affected Systems

The flaw affects installations of CodeAstro Ecommerce Website version 1.0. Any instance that has not received a vendor patch and exposes the /ecommerce-website-php/customer/my_account.php?edit_account endpoint is vulnerable to exploitation.

Risk and Exploitability

The CVSS score moderate impact, and the EPSS score of < 1% demonstrates a very low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting no widespread field use yet, but publicly disclosed exploits confirm the feasibility of a remote attack via crafted HTTP requests.

Generated by OpenCVE AI on July 24, 2026 at 09:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update CodeAstro Ecommerce Website to a version that includes the fix for the SQL injection flaw in my_account.php.
  • Sanitize the c_name input and use parameterized queries or an ORM to prevent injection attacks.
  • Deploy a Application Firewall or application-layer request filters to detect and block SQL injection attempts targeting the account editing endpoint.

Generated by OpenCVE AI on July 24, 2026 at 09:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 18:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /ecommerce-website-php/customer/my_account.php?edit_account. Such manipulation of the argument c_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Title CodeAstro Ecommerce Website my_account.php sql injection
First Time appeared Codeastro
Codeastro ecommerce Website
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:codeastro:ecommerce_website:*:*:*:*:*:*:*:*
Vendors & Products Codeastro
Codeastro ecommerce Website
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Codeastro Ecommerce Website
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-07T02:32:28.163Z

Reserved: 2026-07-03T17:28:15.303Z

Link: CVE-2026-14639

cve-icon Vulnrichment

Updated: 2026-07-07T02:32:23.816Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')