Executive brief
Fruits-Bazar, an e-commerce platform built with PHP, contains a security flaw that allows unauthorized access to its database. By sending specially crafted web requests, an attacker can bypass security measures to view sensitive information stored in the system's database, such as customer details or administrative data. This could lead to a significant data breach and loss of customer trust.
Technical details
A SQL injection vulnerability exists in Fruits-Bazar Ecommerce Project 1.0 within the '/show_price_by_pdtId.php' endpoint. The application fails to properly sanitize the 'pid' (product ID) parameter before using it in a database query via the MySQLi extension. A remote, unauthenticated attacker can exploit this by sending a crafted HTTP request containing SQL commands. Successful exploitation allows the attacker to perform unauthorized data retrieval (Union-based or Error-based SQLi) from the underlying database. No patch is currently documented in the advisory.
Affected products
- Fruits-Bazar Fruits-Bazar Ecommerce Project 1.0
Timeline
- 2026-07-30: disclosed: CVE published to NVD