CVE-2026-85643: code-projects Online Shopping System adduser.php mysqli_query sql injection
A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be performed remotely, but the CVSS vector indicates high privileges are required. No user interaction is required.
Which input and component are affected?
The SQL injection is associated with manipulation of the mobile argument in admin/adduser.php, specifically where it reaches mysqli_query.
How urgent is remediation?
The issue is rated medium severity with a 4.7 CVSS score. Public exploit code has been published, which may make exploitation more likely where an attacker has the required privileges.