CVE-2026-0578
📋 TL;DR
This SQL injection vulnerability in Online Product Reservation System 1.0 allows attackers to manipulate database queries through the /handgunner-administrator/delete.php file. Remote attackers can potentially read, modify, or delete database contents. All users running this specific software version are affected.
💻 Affected Systems
- code-projects Online Product Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Public proof-of-concept exploit available on GitHub, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider applying manual fixes or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or input validation to the delete.php file
Modify /handgunner-administrator/delete.php to use prepared statements with PDO or mysqli
Access Restriction
allRestrict access to the vulnerable endpoint
Add authentication requirement or IP whitelisting to /handgunner-administrator/delete.php
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check if /handgunner-administrator/delete.php exists and accepts ID parameter without proper validationCheck Version:
Check software version in application files or documentationVerify Fix Applied:
Test the delete.php endpoint with SQL injection payloads to ensure they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual database queries from web server
- Multiple failed delete operations
- SQL syntax errors in application logs
Network Indicators:
- HTTP requests to /handgunner-administrator/delete.php with SQL payloads in parameters
SIEM Query:
source="web_server" AND uri="/handgunner-administrator/delete.php" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "--")🔗 References
- https://code-projects.org/
- https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_admin_delete.php.md
- https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_admin_delete.php.md#poc
- https://vuldb.com/?ctiid.339462
- https://vuldb.com/?id.339462
- https://vuldb.com/?submit.731075
