CVE-2026-0584
📋 TL;DR
CVE-2026-0584 is a SQL injection vulnerability in code-projects Online Product Reservation System 1.0 that allows attackers to execute arbitrary SQL commands via the ID parameter in app/products/left_cart.php. This affects all users running this specific software version, potentially enabling unauthorized database access, data theft, or system compromise.
💻 Affected Systems
- code-projects Online Product Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to execute arbitrary commands.
Likely Case
Unauthorized access to sensitive reservation data, customer information, or administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing successful exploitation.
🎯 Exploit Status
Public proof-of-concept exploit available; remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check vendor website for security updates 2. Apply any available patches 3. Verify fix by testing the vulnerable endpoint
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries for the ID parameter in left_cart.php
Modify app/products/left_cart.php to use prepared statements
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Configure WAF to block suspicious SQL patterns in requests to */app/products/left_cart.php*
🧯 If You Can't Patch
- Isolate the system from internet access and restrict to internal network only
- Implement network segmentation and strict access controls to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Test the left_cart.php endpoint with SQL injection payloads in the ID parameterCheck Version:
Check software version in configuration files or admin panelVerify Fix Applied:
Attempt SQL injection tests and verify they are blocked or properly handled📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web logs
Network Indicators:
- Suspicious HTTP requests to left_cart.php with SQL payloads
SIEM Query:
source="web_logs" AND uri="*left_cart.php*" AND (query="*UNION*" OR query="*SELECT*" OR query="*INSERT*")🔗 References
- https://code-projects.org/
- https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_left_cart.php.md
- https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_left_cart.php.md#poc
- https://vuldb.com/?ctiid.339476
- https://vuldb.com/?id.339476
- https://vuldb.com/?submit.731095
