CVE-2025-26156: SQL Injection
A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26156?
CVE-2025-26156 has been classified as a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2025-26156?
To fix CVE-2025-26156, validate and sanitize input for the orderid POST request parameter to prevent SQL injection attacks.
What systems are affected by CVE-2025-26156?
CVE-2025-26156 affects PHPGurukul Online Shopping Portal version 2.1 specifically.
What kind of attack can be executed using CVE-2025-26156?
CVE-2025-26156 allows remote attackers to execute arbitrary SQL commands via the vulnerable orderid parameter.
Is CVE-2025-26156 easy to exploit?
Yes, CVE-2025-26156 can be easily exploited by crafting specific POST requests that manipulate the orderid parameter.