Description

A vulnerability was determined in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file /app/checkout/delete.php of the component POST Parameter Handler. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Related CPE's

a

fabian

online_product_reservation_system

1.0

Vulnerable

References

https://code-projects.org/

Product

https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_checkout_delete.php.md

ExploitThird Party Advisory

https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_checkout_delete.php.md#poc

ExploitThird Party Advisory

https://vuldb.com/?ctiid.339500

Permissions RequiredVDB Entry

https://vuldb.com/?id.339500

Third Party AdvisoryVDB Entry

https://vuldb.com/?submit.731128

Third Party AdvisoryVDB Entry

Weaknesses

[email protected]

Primary
CWE-74CWE-89

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

6.3 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2026-01-05T13:15:55.643Z

1 week ago

Last modified

2026-01-09T15:07:02.847Z

6 days ago