Executive brief
A security vulnerability exists in the CodeAstro Ecommerce Website, a platform used for online retail. An attacker with a low-level user account can exploit a flaw in the payment confirmation process to access or manipulate the underlying database. This could lead to the theft of sensitive customer information, modification of order statuses, or disruption of the website's operations.
Technical details
A SQL injection vulnerability exists in CodeAstro Ecommerce Website 1.0 within the /ecommerce-website-php/customer/confirm.php file. The root cause is the failure of the POST Parameter Handler to sanitize or parameterize the 'invoice_no' multipart POST argument before concatenating it into a MySQL query. A remote attacker with low-privileged (customer) authentication can submit a crafted multipart/form-data request to execute arbitrary SQL commands. This can be used to extract sensitive data, modify database records, or perform time-based blind injection attacks. A public exploit (PoC) has been released, but no official patch is currently documented.
Affected products
- CodeAstro Ecommerce Website 1.0
Timeline
- 2026-07-05: advisory: NVD publication date
- 2026-06-06: disclosed: Public exploit/Gist published by researcher