CVE-2025-11597
📋 TL;DR
This SQL injection vulnerability in code-projects E-Commerce Website 1.0 allows attackers to manipulate database queries through the prod_id parameter in product_add_qty.php. Attackers can potentially read, modify, or delete database content, including sensitive customer and order information. All deployments of this specific e-commerce software version are affected.
💻 Affected Systems
- code-projects E-Commerce Website
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining
Likely Case
Unauthorized data access including customer PII, order details, and administrative credentials
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data
🎯 Exploit Status
Public exploit available, remote unauthenticated exploitation possible via HTTP requests
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to maintained e-commerce platform or implementing custom fixes with parameterized queries
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure prod_id parameter contains only numeric values
Add to product_add_qty.php: if(!is_numeric($_POST['prod_id'])) { die('Invalid input'); }
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
ModSecurity rule: SecRule ARGS:prod_id "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with strict input validation
- Implement database user with minimal permissions (read-only for frontend queries)
🔍 How to Verify
Check if Vulnerable:
Test with SQL injection payload: product_add_qty.php?prod_id=1' OR '1'='1Check Version:
Check PHP files for version comments or compare with known 1.0 source codeVerify Fix Applied:
Attempt SQL injection tests and verify they return error messages rather than executing📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web logs
- Multiple rapid requests to product_add_qty.php with varying prod_id parameters
Network Indicators:
- HTTP requests containing SQL keywords (UNION, SELECT, INSERT) in prod_id parameter
SIEM Query:
source="web_logs" AND uri="/pages/product_add_qty.php" AND (prod_id="*'*" OR prod_id="*;*" OR prod_id="*--*" OR prod_id="*/*")