CVE-2023-38890

CVE-2023-38890 説明 Online Shopping Portal Project V3.1 は、ログインフォームを介してリモートの攻撃者が任意のSQLコマンド/クエリを実行することを許可し、不正アクセスやデータ操作につながる可能性があります。この脆弱性は、ユーザーが入力したusernameフィールドの検証が不十分なために発生し、SQLインジェクション攻撃を可能にします。 エクスプロイトタイトル: Online Shopping Portal Project V3.1 PHPgurukul - Time-Based Blind Sqli エクスプロイト作成者: Akshad...

CVE-2024-39090-PoC

CVE-2024-39090 PoC Exploit Script このPoCスクリプトは、PHPGurukul Online Shopping Portal v2.0におけるCSRFからStored XSSへの脆弱性であるCVE-2024-39090を悪用します。CSRF攻撃を自動化して永続的なJavaScriptペイロードを注入し、特権ユーザーが影響を受けるページにアクセスすると実行され、セッションハイジャックや資格情報の窃取などのアクションが可能になります。...

DWrwq

説明 PHPGurukul Online Shopping Portal 2.1 は /admin/updateorder.php にクロスサイトスクリプティング XSS の脆弱性があります。 脆弱性の概要 1.脆弱性タイプ: 保存型クロスサイトスクリプティング XSS 2.影響を受ける製品: Online Shopping Portal Project - 2.1 3.影響を受けるコンポーネント: /shopping/admin/updateorder.php?oid=0 4.攻撃タイプ: 保存型クロスサイトスクリプティング XSS 再現手順 1.アプリケーションをセットアップする :...

CVE-2025-51820

CVE-2025-51820 Online Shopping Portal v1.0 において、重大なリモートコード実行（RCE）脆弱性（CVE-2025-51820）が発見されました。 🚨 Online Shopping Portal Project v1.0 におけるリモートコード実行（CVE-2025-51820） 🔍 はじめに 今日のデジタル世界において、リモートコード実行（RCE） は依然として最も危険な Web アプリケーション脆弱性の 1 つです。本レポートは、phpgurukul による Online Shopping Portal Project v1.0...

CVE-2026-8128 SourceCodester SUP Online Shopping viewmsg.php sql injection

A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the file /admin/viewmsg.php. Performing a manipulation of the argument msgid results in sql injection. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2026-5640

A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.php of the component Parameter Handler. The manipulation of the argument filename leads to sql injection. The attack is possible to be...

CVE-2026-5636

A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /cancelorder.php of the component Parameter Handler. This manipulation of the argument oid causes sql injection. The attack may be initiated remotely. The exploit has been mad...

CVE-2026-5639

A flaw has been found in PHPGurukul Online Shopping Portal Project 2.1. Impacted is an unknown function of the file /admin/update-image3.php of the component Parameter Handler. Executing a manipulation of the argument filename can lead to sql injection. The attack can be executed remotely. The...

CVE-2026-5606

A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /order-details.php of the component Parameter Handler. The manipulation of the argument orderid results in sql injection. It is possible to launch the atta...

EUVD-2026-19211

A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /admin/update-image1.php of the component Parameter Handler. The manipulation of the argument filename results in sql injection. The attack may be performed from...

EUVD-2026-19193

A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categorywise-products.php of the component Parameter Handler. The manipulation of the argument cid results in sql injection. The attack can be...

CVE-2026-5641 PHPGurukul Online Shopping Portal Project Parameter update-image1.php sql injection

A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /admin/update-image1.php of the component Parameter Handler. The manipulation of the argument filename results in sql injection. The attack may be performed from...

CVE-2026-5641

The CVE-2026-5641 issue affects PHPGurukul Online Shopping Portal Project 2.1, specifically the /admin/update-image1.php file in the Parameter Handler. The vulnerability arises from manipulating the filename argument, leading to SQL injection. It can be exploited remotely, and the exploit has bee...

CVE-2026-5641 PHPGurukul Online Shopping Portal Project Parameter update-image1.php sql injection

A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /admin/update-image1.php of the component Parameter Handler. The manipulation of the argument filename results in sql injection. The attack may be performed from...

CVE-2026-5640 PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection

A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.php of the component Parameter Handler. The manipulation of the argument filename leads to sql injection. The attack is possible to be...

CVE-2026-5639 PHPGurukul Online Shopping Portal Project Parameter update-image3.php sql injection

A flaw has been found in PHPGurukul Online Shopping Portal Project 2.1. Impacted is an unknown function of the file /admin/update-image3.php of the component Parameter Handler. Executing a manipulation of the argument filename can lead to sql injection. The attack can be executed remotely. The...

CVE-2026-5636 PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection

A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /cancelorder.php of the component Parameter Handler. This manipulation of the argument oid causes sql injection. The attack may be initiated remotely. The exploit has been mad...

CVE-2026-5635 PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection

A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categorywise-products.php of the component Parameter Handler. The manipulation of the argument cid results in sql injection. The attack can be...

CVE-2026-5635

A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categorywise-products.php of the component Parameter Handler. The manipulation of the argument cid results in sql injection. The attack can be...

CVE-2026-5635

CVE-2026-5635 affects PHPGurukul Online Shopping Portal Project 2.1. The vulnerability is in the Parameter Handler’s /categorywise-products.php, where manipulating the cid parameter leads to SQL injection. Attacks can be launched remotely and the exploit has been released publicly. Concrete remed...