CVE-2026-85643

code-projects Online Shopping System adduser.php mysqli_query sql injection

View on CVE.org
Published Sep 4, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

Analysis

AI-generated

Technical impact

The vulnerability resides in the adduser.php file of code-projects Online Shopping System 1.0. An attacker can inject arbitrary SQL through the unvalidated mobile parameter, which is directly passed to mysqli_query. This flaw falls under CWE‑74 and CWE‑89 and can allow the execution of malicious SQL statements.

Affected Systems

The affected product is code-projects Online Shopping System version 1.0. No other versions are listed; the vulnerability appears in that single version. Administrators who have access to the add user functionality are at risk.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity and the EPSS is not available, but the exploit has been published and can be carried out remotely. The vulnerability is not listed in the CISA KEV catalog. Attackers who can reach the admin interface could manipulate database contents or extract sensitive data. The lack of input sanitization makes exploitation trivial in the absence of other access controls.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the online‑shopping‑system to the latest released version that contains a fix for this injection flaw.
  • If an update is unavailable, modify admin/adduser.php to use prepared statements or, at a minimum, escape the mobile parameter with mysqli_real_escape_string before concatenating it into the query.
  • Restrict administrative access to trusted users, ideally limiting the add user feature to a secure, authenticated environment behind a firewall or VPN, to reduce the attack surface.

Generated by OpenCVE AI on September 4, 2026 at 20:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Title code-projects Online Shopping System adduser.php mysqli_query sql injection
First Time appeared Code-projects
Code-projects online Shopping System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Shopping System
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 5:30 PM
Reserved
Sep 4, 2026, 12:33 PM

View source JSON

Updated
Sep 8, 2026, 5:30 PM

JSON

Status
Deferred
Published
Sep 4, 2026, 8:17 PM
Modified
Sep 8, 2026, 6:21 PM

View source JSON

No data.

Updated
Sep 5, 2026, 3:00 AM

JSON