A SQL injection flaw exists in the checkout_process.php file of the code-projects Online Shopping System. Manipulating the total_count argument can cause an attacker to inject arbitrary SQL statements, potentially allowing unauthorized data exposure, modification, or deletion. The weakness is classified under CWE-74 and CWE-89, indicating improper handling of input that is directly incorporated into a SQL query.

The vulnerability affects code-projects Online Shopping System version 1.0. No other products or versions are listed as affected. The specific file implicated is /checkout_process.php, but the exact component within the file is unknown from the available data.

The CVSS v3 score of 5.3 indicates moderate severity, and the EPSS score is not available, but a publicly available exploit demonstrates that the flaw is actionable. Because the attack can be launched remotely and the exploit is already published, the likelihood of exploitation in the wild is non‑negligible. The system’s exposure is limited to the parts of the database accessed through the checkout process, but an attacker could gain access to sensitive customer data or manipulate order information.