Description
A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown function of the file /admin/login.php of the component Admin Login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Published: 2026-07-04
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw exists in the /admin/login.php script of SourceCodester Simple and Nice Shopping Cart Script that allows an attacker to inject arbitrary SQL through an unsanitized Username field. The injected code can manipulate database queries, potentially exposing, modifying, or deleting sensitive information and elevating the attacker’s privileges. The vulnerability maps to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Encoding or Escaping).

Affected Systems

Affected versions are not specified in the available data. The flaw resides in the Admin Login component of SourceCodester Simple and Nice Shopping Cart Script, but no particular release has been identified as impacted.

Risk and Exploitability

The CVSS score of 6.9 reflects a moderate severity. An EPSS score of less than 1% indicates a very low yet non‑zero chance of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the publicly accessible /admin/login.php endpoint; exploit code has been released, confirming that remote exploitation is feasible.

Generated by OpenCVE AI on July 24, 2026 at 09:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of Simple and Nice Shopping Cart Script from SourceCodester, which implements proper input validation and parameterized queries in the login process.
  • Limit access to /admin/login.php by IP filtering, VPN, or firewall rules soAudit the login code to ensure that the Username input is either escaped or bound through prepared statements, eliminating the conditions that enable CWE-89 and CWE-74.
  • Deploy a web application firewall to monitor and block SQL injection patterns targeting the /admin/login.php endpoint.

Generated by OpenCVE AI on July 24, 2026 at 09:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown function of the file /admin/login.php of the component Admin Login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Title SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injection
First Time appeared Sourcecodester
Sourcecodester simple And Nice Shopping Cart Script
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_and_nice_shopping_cart_script:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple And Nice Shopping Cart Script
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Simple And Nice Shopping Cart Script
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T13:51:02.190Z

Reserved: 2026-07-03T18:44:16.476Z

Link: CVE-2026-14652

cve-icon Vulnrichment

Updated: 2026-07-06T13:50:58.812Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:00:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')