Executive brief
Online Shopping System is an open-source e-commerce platform. An attacker with administrative access can inject malicious SQL code through the user creation form's phone field, allowing them to extract sensitive database information or modify records. This could expose customer payment data, personal information, and compromise the integrity of the entire system.
Technical details
The vulnerability is a classic SQL injection flaw in admin/adduser.php where user-supplied input from the mobile/phone field is concatenated directly into a mysqli_query INSERT statement without any sanitization or parameterized queries. The vulnerable code takes seven POST parameters (first_name, last_name, email, password, mobile, address1, address2) and passes them directly into the SQL query. An attacker with admin credentials can craft a malicious phone number containing SQL metacharacters and logic (e.g., sleep() for time-based injection) to extract data via error-based or blind injection techniques. No authentication bypass is required—the attacker must already have admin access to the /admin/adduser.php endpoint. Patching requires using prepared statements or parameterized queries with mysqli bind_param().
Affected products
- code-projects Online Shopping System 1.0
Timeline
- 2026-09-04: disclosed