CVE-2026-0575
📋 TL;DR
This SQL injection vulnerability in code-projects Online Product Reservation System 1.0 allows attackers to manipulate database queries through the administrator login page. Attackers can potentially bypass authentication, access sensitive data, or execute arbitrary SQL commands. Any organization using this specific software version with internet-facing login pages is affected.
💻 Affected Systems
- code-projects Online Product Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, authentication bypass, privilege escalation, and potential remote code execution on the database server.
Likely Case
Authentication bypass allowing unauthorized administrative access, data exfiltration of user/reservation information, and potential system takeover.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation preventing successful exploitation.
🎯 Exploit Status
Public proof-of-concept available showing SQL injection via emailadd and pass parameters. Exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Manually fix vulnerable code by implementing parameterized queries and input validation in adminlogin.php.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the admin login endpoint
Network Access Control
linuxRestrict access to /handgunner-administrator/ directory to trusted IP addresses only
# Apache: Order deny,allow
Deny from all
Allow from 192.168.1.0/24
# Nginx: allow 192.168.1.0/24; deny all;
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement strong authentication before reaching the vulnerable login page
🔍 How to Verify
Check if Vulnerable:
Test the adminlogin.php endpoint with SQL injection payloads in emailadd or pass parameters and observe database errors or unexpected responsesCheck Version:
Check software version in documentation or configuration files; system does not have built-in version commandVerify Fix Applied:
Attempt SQL injection tests after implementing parameterized queries and confirm proper error handling without database exposure📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in login attempts
- Multiple failed login attempts with SQL keywords
- Database error messages in application logs
Network Indicators:
- HTTP POST requests to /handgunner-administrator/adminlogin.php containing SQL injection patterns
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="/handgunner-administrator/adminlogin.php" AND (body CONTAINS "UNION" OR body CONTAINS "SELECT" OR body CONTAINS "OR 1=1")🔗 References
- https://code-projects.org/
- https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_admin_login.md
- https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_admin_login.md#poc
- https://vuldb.com/?ctiid.339459
- https://vuldb.com/?id.339459
- https://vuldb.com/?submit.731011
