CVE-2026-0585: code-projects Online Product Reservation System GET Parameter order_view.php sql injection
A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the file /orderview.php of the component GET Parameter Handler. Such manipulation of the argument transactionid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0585?
CVE-2026-0585 has not been officially rated, but it poses a significant risk due to its potential for exploiting SQL injection vulnerabilities.
How do I fix CVE-2026-0585?
To mitigate CVE-2026-0585, validate and sanitize the 'transaction_id' parameter before processing it in the application.
What systems are affected by CVE-2026-0585?
CVE-2026-0585 affects the Code-projects Online Product Reservation System version 1.0.
What type of vulnerability is CVE-2026-0585?
CVE-2026-0585 is classified as an SQL injection vulnerability affecting the GET Parameter Handler.
Can CVE-2026-0585 be exploited remotely?
Yes, CVE-2026-0585 can potentially be exploited remotely through crafted HTTP requests that manipulate the 'transaction_id' parameter.