Executive brief
SourceCodester Simple and Nice Shopping Cart Script, a web application for managing online stores, contains a security flaw in its administrative product deletion feature. An attacker can exploit this to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive customer information or the modification of store data. This attack can be performed remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in SourceCodester Simple and Nice Shopping Cart Script 1.0 within the '/admin/girlsproductdeletequery.php' component. The application fails to properly sanitize or validate the 'user_id' GET parameter before using it in a database query. An unauthenticated remote attacker can exploit this by sending specially crafted SQL payloads, such as time-based blind injection strings, to manipulate database operations. Successful exploitation allows for unauthorized data retrieval, modification, or deletion. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- SourceCodester Simple and Nice Shopping Cart Script 1.0
Timeline
- 2026-06-03: disclosed: Vulnerability details and PoC published on GitHub by Yuesswor.
- 2026-07-04: advisory: NVD/VulDB advisory published.