This vulnerability is a SQL injection flaw in the Online Shopping System’s action.php file. By manipulating the proId argument, an attacker can inject arbitrary SQL commands, potentially gaining unauthorized read or write access to the underlying database. Because the flaw operates on a remote web interface, the impact is confined to the scope of the affected application but can lead to data confidentiality and integrity compromise, as well as potential application denial of service if the database is misused.

The flaw exists in code‑projects Online Shopping System version 1.0. The affected component is the undocumented function within action.php that processes the proId request parameter. Administrators should confirm whether this legacy version is deployed and whether the specific file is exposed via a public web endpoint.

The CVSS score of 5.3 places the vulnerability in the medium severity range, and the EPSS score is not available, indicating insufficient data to assess current exploitation likelihood. The vulnerability is publicly disclosed and can be triggered remotely from any network source that can reach the application’s /action.php endpoint. The vulnerability is not listed in CISA’s KEV catalog, but its remote SQL injection nature implies that discovery combined with lack of input validation makes exploitation relatively straightforward using existing SQL injection tools or manual probing.