CVE-2026-15703

SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Analysis

AI-generated

Technical impact

The vulnerability is an SQL injection flaw located in the SourceCodester Simple and Nice Shopping Cart Script file /admin/userproductdeletequery.php. By manipulating the user_id parameter, an attacker can inject arbitrary SQL commands that are executed by the backend database. This weakness falls under CWE-89 and may also involve unsanitized input handling (CWE-74). The impact includes the potential for unauthorized data disclosure, tampering, or deletion, which is inferred from the nature of SQL injection and affects the integrity and confidentiality of product and administrative data.

Affected Systems

SourceCodester Simple and Nice Shopping Cart Script version 1.0 is affected. The vulnerability resides in the admin module script /admin/userproductdeletequery.php, which, based on the file path, is inferred to be part of the back‑end administration interface. Any installation running this version without applying the latest fix is vulnerable.

Risk and Exploitability

The CVSS score is 6.9, indicating a moderate severity. The EPSS score is under 1%, showing a low probability that the vulnerability is actively exploited, and it is not included in the CISA KEV catalog. The flaw can be triggered remotely by sending a crafted HTTP request containing a malicious user_id value to the affected endpoint. The successful exploit would grant the attacker the ability to execute arbitrary SQL commands against the application database.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to a version of SourceCodester Simple and Nice Shopping Cart Script that eliminates the vulnerable code.
  • If a patch is not available, modify the userproductdeletequery.php file to use prepared statements or parameterized queries that safely handle the user_id input.
  • Restrict the database account used by the application to the minimum privileges required for normal operation, disabling unnecessary SQL functions.

Generated by OpenCVE AI on August 1, 2026 at 09:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Title SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection
First Time appeared Sourcecodester
Sourcecodester simple And Nice Shopping Cart Script
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_and_nice_shopping_cart_script:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple And Nice Shopping Cart Script
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 3:45 PM
Reserved
Jul 14, 2026, 5:39 AM

View source JSON

Updated
Jul 15, 2026, 3:45 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 5:16 PM
Modified
Oct 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Aug 1, 2026, 10:00 AM

JSON