PuneethReddyHC Online Shopping System homeaction.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. id: CVE-2021-41649 info: name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection...

CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 online-shopping-system의 SQL 인젝션 online-shopping-system은 인증되지 않은 오류/boolean 기반 블라인드 및 오류 기반 SQL 인젝션 공격에 취약합니다. /homeaction.php 페이지의 catid 매개변수는 사용자 입력을 검증하지 않으며, 공격자는 기본 MySQL 데이터베이스에서 민감한 데이터를 추출할 수 있습니다. 애플리케이션 링크 online-shopping-system 영향받는 구성 요소 및 매개변수 URL:...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648: online-shopping-system의 SQL 인젝션 online-shopping-system은 인증되지 않은 오류 기반/boolean 기반 블라인드 및 오류 기반 SQL 인젝션 공격에 취약합니다. /action.php 페이지의 proId 파라미터는 사용자 입력을 검증하지 않으므로, 공격자는 기본 MySQL 데이터베이스에서 민감한 데이터를 추출할 수 있습니다. 애플리케이션 링크 online-shopping-system 영향을 받는 구성 요소 및 파라미터 URL:...

CVE-2024-50968

CVE-2024-50968 Описание Уязвимость бизнес-логики существует в функции добавления в корзину Add to Cart системы интернет-магазина Agri-Trading Online Shopping System 1.0 от itsourcecode, что позволяет удаленным атакующим манипулировать параметром quant при добавлении товара в корзину. Установив...

CVE-2024-40498

CVE-2024-40498 영향을 받는 애플리케이션 online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced 설명 파일 register.php는 사용자 등록을 처리합니다. 117번째 줄에서 POST 매개변수 "$address1" 및 $address2"는 이메일, 이름 및 번호와 달리 검증되지 않아 VALUES 문 평가 중 SQL 인젝션이 발생합니다. 취약점을 악용하려면 "register.php" 파일에...

CVE-2025-61246

CVE-2025-61246 - 온라인 쇼핑 시스템의 SQL 인젝션 취약점 개요 이 저장소는 Online Shopping System PHP 애플리케이션에서 발견된 치명적인 SQL 인젝션 취약점인 CVE-2025-61246 에 대한 개념 증명PoC을 포함합니다. 이 취약점은 인증되지 않은 공격자가 시간 기반 블라인드 SQL 인젝션을 통해 임의의 SQL 명령을 실행할 수 있게 합니다. 취약점 세부 정보 CVE ID : CVE-2025-61246 취약점 유형 : SQL 인젝션시간 기반 블라인드 영향을 받는 구성 요소 :...

CVE-2025-52021

CVE-2025-52021 — PuneethReddyHC / Online Shopping System Advanced v1.0의 시간 기반 블라인드 SQL 인젝션 CVE: CVE-2025-52021 제목: editproduct.php의 productid 매개변수를 통한 시간 기반 블라인드 SQL 인젝션 공급업체 / 저장소: PuneethReddyHC — https://github.com/PuneethReddyHC/online-shopping-system-advanced 영향받는 버전: 1.0 테스트 시점의 master 브랜치/...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - 온라인 쇼핑 시스템 Advanced에서의 SQL 인젝션 요약 Online Shopping System Advanced 프로젝트PuneethReddyHC 개발에서 심각한 SQL 인젝션 취약점이 발견되었습니다. 이 결함은 action.php에 있으며, keyword POST 매개변수에서 사용자 입력을 제대로 살균하지 못합니다. 공격자는 악성 SQL을 주입하여 데이터를 추출하거나 데이터베이스를 조작할 수 있습니다. 기술 세부 사항 취약점 유형 : SQL 인젝션 영향 받는 파일...

CVE-2026-85643

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-85643 code-projects Online Shopping System adduser.php mysqli_query sql injection

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-85643

code-projects Online Shopping System 1.0 is vulnerable to SQL injection in the mysqli_query function within admin/adduser.php , via manipulation of the mobile argument. The attack is exploitable remotely but requires high privileges (authenticated admin access). CVSS 3.1 scores it 4.7 (MEDIUM) wi...

EUVD-2026-71713

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

PT-2026-86240

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be use...

CVE-2026-82701

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82700

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...

EUVD-2026-68594

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82701

A SQL injection vulnerability exists in the Search Functionality of code-projects Online Shopping System 1.0 , specifically in the keyword parameter of /action.php. An unauthenticated remote attacker can manipulate this argument to inject SQL, achieving low impact on confidentiality, integrity, a...

CVE-2026-82701 code-projects Online Shopping System Search Functionality action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82700

A cross-site scripting (XSS) vulnerability exists in the Newsletter Subscription component of code-projects Online Shopping System 1.0 , specifically in the file /offersmail.php . Manipulation of the email argument allows a remote, unauthenticated attacker to inject script, resulting in low impac...

EUVD-2026-68530

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...