Executive brief
SourceCodester Simple and Nice Shopping Cart Script, a web application for managing online stores, contains a security flaw in its administrative product management component. An attacker can exploit this to manipulate the underlying database without needing a username or password. This could lead to the theft of customer data, unauthorized modification of product listings, or a complete shutdown of the shopping site.
Technical details
A SQL injection vulnerability exists in SourceCodester Simple and Nice Shopping Cart Script 1.0 due to insufficient sanitization of the 'user_id' GET parameter in the '/admin/mensproductdeletequery.php' script. The application directly incorporates this user-supplied input into a SQL query, allowing for time-based blind SQL injection. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized database access, data exfiltration, or data deletion. A public proof-of-concept (PoC) using sqlmap has been disclosed. No official patch is currently documented; users are advised to implement prepared statements and parameter binding.
Affected products
- SourceCodester Simple and Nice Shopping Cart Script 1.0
Timeline
- 2026-06-03: disclosed: Initial discovery and disclosure on GitHub by Yuesswor
- 2026-07-04: advisory: NVD publication date