Description
A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown function of the file /admin/login.php of the component Admin Login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Published: 2026-07-04
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw exists in the /admin/login.php script of SourceCodester Simple and Nice Shopping Cart Script. The Username parameter is not sanitized, allowing injection of arbitrary SQL commands into the database query. This vulnerability can enable an attacker to execute unintended SQL statements, potentially exposing, modifying, or deleting data within the application’s database.

Affected Systems

The vulnerability affects SourceCodester Simple and Nice Shopping Cart Script. No specific release or version has been identified as impacted; the flaw resides in the Admin Login component of the script.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score is less than 1%, implying a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the publicly accessible /admin/login.php endpoint; exploit code has been released, confirming that remote exploitation is possible.

Generated by OpenCVE AI on August 1, 2026 at 19:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of Simple and Nice Shopping Cart Script from SourceCodester, which addresses the SQL injection vulnerability in admin/login.php.
  • Restrict access to /admin/login.php by configuring firewall rules, IP whitelisting, or VPN to limit exposure to trusted administrators.
  • Configure a web application firewall to detect and block SQL injection patterns targeting the Username parameter in the login request.

Generated by OpenCVE AI on August 1, 2026 at 19:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown function of the file /admin/login.php of the component Admin Login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Title SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injection
First Time appeared Sourcecodester
Sourcecodester simple And Nice Shopping Cart Script
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_and_nice_shopping_cart_script:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple And Nice Shopping Cart Script
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Simple And Nice Shopping Cart Script
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T13:51:02.190Z

Reserved: 2026-07-03T18:44:16.476Z

Link: CVE-2026-14652

cve-icon Vulnrichment

Updated: 2026-07-06T13:50:58.812Z

cve-icon NVD

Status : Deferred

Published: 2026-07-04T21:17:14.840

Modified: 2026-07-06T18:02:49.450

Link: CVE-2026-14652

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T19:45:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')