Description
A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /signup.php. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-02-25
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the signup.php script of Simple and Nice Shopping Cart Script 1.0. By sending a crafted Username parameter, an attacker can perform SQL injection that may lead to unauthorized data access or modification. This flaw allows execution of arbitrary SQL statements against the underlying database.

Affected Systems

SourceCodester Simple and Nice Shopping Cart Script version 1.0, used on web servers hosting the shopping cart application. The vulnerability is tied to the signup.php file within this product.

Risk and Exploitability

The CVSS base score of 6.9 indicates moderate severity, while the EPSS score of less than 1% implies a low likelihood of exploitation within the current prevalence. The flaw can be triggered remotely through the public web interface, and is publicly disclosed with documented proof of concept. Although it is not listed in the KEV catalog, the lack of an immediate patch means administrators must act promptly to mitigate potential attacks.

Generated by OpenCVE AI on April 17, 2026 at 15:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for and install the vendor‑supplied patch or upgrade to a newer release of Simple and Nice Shopping Cart Script.
  • Apply input validation to the Username field, allowing only safe characters or enforce prepared statements to prevent injection.
  • Restrict the database account used by the application to the minimum privileges required, such as read‑only for registration operations.
  • Implement a web application firewall to block common SQL injection payloads as an additional defense.

Generated by OpenCVE AI on April 17, 2026 at 15:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 25 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Haben-cs9
Haben-cs9 simple And Nice Shopping Cart Script
CPEs cpe:2.3:a:haben-cs9:simple_and_nice_shopping_cart_script:1.0:*:*:*:*:*:*:*
Vendors & Products Haben-cs9
Haben-cs9 simple And Nice Shopping Cart Script

Wed, 25 Feb 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester simple And Nice Shopping Cart Script
Vendors & Products Sourcecodester
Sourcecodester simple And Nice Shopping Cart Script

Wed, 25 Feb 2026 05:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /signup.php. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Title SourceCodester Simple and Nice Shopping Cart Script signup.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Haben-cs9 Simple And Nice Shopping Cart Script
Sourcecodester Simple And Nice Shopping Cart Script
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-25T21:14:25.878Z

Reserved: 2026-02-24T20:03:59.020Z

Link: CVE-2026-3148

cve-icon Vulnrichment

Updated: 2026-02-25T21:14:21.477Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-25T05:17:27.323

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-3148

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T15:30:06Z

Weaknesses