CVE-2025-11070: Projectworlds Online Shopping System cart_add.php sql injection
Published Sep 27, 2025
·Updated
A vulnerability was identified in Projectworlds Online Shopping System 1.0. This affects an unknown part of the file /store/cartadd.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Affected Software
2 affected components
Projectworlds Online Shopping System
Projectworlds Online Shopping System=1.0
Event History
Sep 27, 2025
CVE Published
via MITRE·05:02 PM
Data Sourced
via MITRE·05:02 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-11070?
CVE-2025-11070 has a medium severity rating due to its potential for SQL injection attacks.
2
How do I fix CVE-2025-11070?
To fix CVE-2025-11070, implement input validation and use prepared statements in all database queries.
3
What systems are affected by CVE-2025-11070?
CVE-2025-11070 affects Projectworlds Online Shopping System version 1.0.
4
Can CVE-2025-11070 be exploited remotely?
Yes, CVE-2025-11070 can be exploited remotely through the vulnerable file /store/cart_add.php.
5
Is there a known exploit for CVE-2025-11070?
Yes, an exploit for CVE-2025-11070 is publicly available.