Executive brief
A vulnerability exists in the SourceCodester Simple and Nice Shopping Cart Script, a web application used for managing online stores. An attacker can exploit a flaw in the administrative login page to bypass security controls and interact directly with the underlying database. This could lead to unauthorized access to the management console, exposure of customer or business data, and potential disruption of the shopping service.
Technical details
A SQL injection vulnerability exists in SourceCodester Simple and Nice Shopping Cart Script 1.0 within the '/admin/login.php' file. The 'username' POST parameter is not properly sanitized or validated before being used in a database query. A remote, unauthenticated attacker can exploit this using boolean-based or time-based blind SQL injection techniques to bypass authentication, extract sensitive information from the database, or modify data. Proof-of-concept exploits using sqlmap have been disclosed publicly. No official patch is currently available; developers are advised to use prepared statements with parameterized queries.
Affected products
- SourceCodester Simple and Nice Shopping Cart Script 1.0
Timeline
- 2026-06-03: disclosed: Vulnerability details and POC shared on GitHub by Yuesswor
- 2026-07-04: advisory: CVE published to NVD dataset