CVE-2026-82701: code-projects Online Shopping System Search Functionality action.php sql injection
A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Deployments of code-projects Online Shopping System 1.0 that expose the Search Functionality through /action.php may be exposed. The issue can be initiated remotely and does not require privileges or user interaction according to the supplied severity vector.
What does an attacker need to exploit it?
An attacker needs to submit a crafted value for the keyword argument handled by the Search Functionality in /action.php. The attack is low complexity, can be performed over the network, and public exploit information has been disclosed.
How can I check whether my deployment is affected?
Verify whether the application is code-projects Online Shopping System 1.0 and whether its search workflow sends a keyword parameter to /action.php. The provided information identifies this parameter and endpoint as the affected path, but does not specify a broader set of affected configurations or versions.