Description
A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Published: 2026-09-04
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the adduser.php file of code-projects Online Shopping System 1.0. An attacker can inject arbitrary SQL through the unvalidated mobile parameter, which is directly passed to mysqli_query. This flaw falls under CWE‑74 and CWE‑89 and can allow the execution of malicious SQL statements.

Affected Systems

The affected product is code-projects Online Shopping System version 1.0. No other versions are listed; the vulnerability appears in that single version. Administrators who have access to the add user functionality are at risk.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity and the EPSS is not available, but the exploit has been published and can be carried out remotely. The vulnerability is not listed in the CISA KEV catalog. Attackers who can reach the admin interface could manipulate database contents or extract sensitive data. The lack of input sanitization makes exploitation trivial in the absence of other access controls.

Generated by OpenCVE AI on September 4, 2026 at 20:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the online‑shopping‑system to the latest released version that contains a fix for this injection flaw.
  • If an update is unavailable, modify admin/adduser.php to use prepared statements or, at a minimum, escape the mobile parameter with mysqli_real_escape_string before concatenating it into the query.
  • Restrict administrative access to trusted users, ideally limiting the add user feature to a secure, authenticated environment behind a firewall or VPN, to reduce the attack surface.

Generated by OpenCVE AI on September 4, 2026 at 20:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Title code-projects Online Shopping System adduser.php mysqli_query sql injection
First Time appeared Code-projects
Code-projects online Shopping System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Shopping System
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Shopping System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-04T19:15:08.310Z

Reserved: 2026-09-04T12:33:59.123Z

Link: CVE-2026-85643

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T20:17:32.853

Modified: 2026-09-04T20:17:32.853

Link: CVE-2026-85643

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T20:45:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')