DWrwq

説明 PHPGurukul Online Shopping Portal 2.1 は /admin/updateorder.php にクロスサイトスクリプティング XSS の脆弱性があります。 脆弱性の概要 1.脆弱性タイプ: 保存型クロスサイトスクリプティング XSS 2.影響を受ける製品: Online Shopping Portal Project - 2.1 3.影響を受けるコンポーネント: /shopping/admin/updateorder.php?oid=0 4.攻撃タイプ: 保存型クロスサイトスクリプティング XSS 再現手順 1.アプリケーションをセットアップする :...

PuneethReddyHC Online Shopping System homeaction.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. id: CVE-2021-41649 info: name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection...

PuneethReddyHC action.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. id: CVE-2021-41648 info: name: PuneethReddyHC action.php SQL Injection author: daffainfo severity: high descriptio...

CVE-2025-52021

CVE-2025-52021 — PuneethReddyHC / Online Shopping System Advanced v1.0 における時間ベースのブラインドSQLインジェクション CVE: CVE-2025-52021 タイトル: editproduct.php の productid パラメータを介した時間ベースのブラインドSQLインジェクション ベンダー / リポジトリ: PuneethReddyHC — https://github.com/PuneethReddyHC/online-shopping-system-advanced 影響を受けるバージョン:...

CVE-2025-61246

CVE-2025-61246 - オンラインショッピングシステムにおけるSQLインジェクション脆弱性 概要 このリポジトリには、CVE-2025-61246 の概念実証（PoC）が含まれています。これは、オンラインショッピングシステムPHPアプリケーションで発見された重大なSQLインジェクション脆弱性です。この脆弱性により、認証されていない攻撃者が、時間ベースのブラインドSQLインジェクションを通じて任意のSQLコマンドを実行できる可能性があります。 脆弱性の詳細 CVE ID : CVE-2025-61246 脆弱性タイプ : SQLインジェクション（時間ベースブラインド）...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - 온라인 쇼핑 시스템 Advanced에서의 SQL 인젝션 요약 Online Shopping System Advanced 프로젝트PuneethReddyHC 개발에서 심각한 SQL 인젝션 취약점이 발견되었습니다. 이 결함은 action.php에 있으며, keyword POST 매개변수에서 사용자 입력을 제대로 살균하지 못합니다. 공격자는 악성 SQL을 주입하여 데이터를 추출하거나 데이터베이스를 조작할 수 있습니다. 기술 세부 사항 취약점 유형 : SQL 인젝션 영향 받는 파일...

CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 online-shopping-system의 SQL 인젝션 online-shopping-system은 인증되지 않은 오류/boolean 기반 블라인드 및 오류 기반 SQL 인젝션 공격에 취약합니다. /homeaction.php 페이지의 catid 매개변수는 사용자 입력을 검증하지 않으며, 공격자는 기본 MySQL 데이터베이스에서 민감한 데이터를 추출할 수 있습니다. 애플리케이션 링크 online-shopping-system 영향받는 구성 요소 및 매개변수 URL:...

CVE-2023-38890

CVE-2023-38890 설명 Online Shopping Portal Project V3.1 는 원격 공격자가 로그인 폼을 통해 임의의 SQL 명령/쿼리를 실행할 수 있게 하여, 인가되지 않은 접근과 잠재적인 데이터 조작을 유발합니다. 이 취약점은 사용자 입력값인 username 필드에 대한 검증이 충분하지 않아 발생하며, SQL 인젝션 공격을 가능하게 합니다. 익스플로잇 제목: Online Shopping Portal Project V3.1 PHPgurukul - 시간 기반 블라인드 SQL 인젝션 익스플로잇 작성자:...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 オンラインショッピングシステムにおけるSQLインジェクション online-shopping-system は、認証なしのエラーベース/ブールベースのブラインドSQLインジェクションおよびエラーベースのSQLインジェクション攻撃に対して脆弱です。 /action.php ページの proId パラメータはユーザー入力をサニタイズしていないため、攻撃者は基盤となるMySQLデータベースから機密データを抽出できます。 アプリケーションへのリンク online-shopping-system 影響を受けるコンポーネントとパラメータ...

CVE-2024-40498

CVE-2024-40498 영향을 받는 애플리케이션 online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced 설명 파일 register.php는 사용자 등록을 처리합니다. 117번째 줄에서 POST 매개변수 "$address1" 및 $address2"는 이메일, 이름 및 번호와 달리 검증되지 않아 VALUES 문 평가 중 SQL 인젝션이 발생합니다. 취약점을 악용하려면 "register.php" 파일에...

CVE-2026-85643

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

EUVD-2026-71713

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-85643

code-projects Online Shopping System 1.0 is vulnerable to SQL injection in the mysqli_query function within admin/adduser.php , via manipulation of the mobile argument. The attack is exploitable remotely but requires high privileges (authenticated admin access). CVSS 3.1 scores it 4.7 (MEDIUM) wi...

CVE-2026-85643 code-projects Online Shopping System adduser.php mysqli_query sql injection

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-85643 code-projects Online Shopping System adduser.php mysqli_query sql injection

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

PT-2026-86240

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be use...

CVE-2026-85643: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-82701

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82700

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...

CVE-2026-82701

A SQL injection vulnerability exists in the Search Functionality of code-projects Online Shopping System 1.0 , specifically in the keyword parameter of /action.php. An unauthenticated remote attacker can manipulate this argument to inject SQL, achieving low impact on confidentiality, integrity, a...