CVE Intelligence
Analysis AI-assisted

CVE-2026-0576: code-projects Online Product Reservation System prod.php SQL Injection

A SQL injection flaw in the prod.php file of code-projects Online Product Reservation System 1.0 can be triggered remotely through several request parameters. NVD lists a base score of 9.8 (critical), and the record states that a public exploit exists. No fixed version is listed in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

A vulnerability was reported in the Online Product Reservation System 1.0 from code-projects. The flaw sits in an unidentified function of the file /handgunner-administrator/prod.php, within the Parameter Handler component. Manipulation of the cat, price, name, model and serial arguments leads to SQL injection. The CNA, VulDB, classifies the weakness as CWE-74 (Injection). See the NVD entry and the VulDB entry.

Impact

  • NVD's base score of 9.8 is the highest score in the record; the listed vector describes network attack, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • Other providers in the record list lower scores, including 7.3 from VulDB and 5.5 and 6.9 from different scoring systems.
  • The practical impact depends on what data the database holds and how the application is exposed. The sources do not describe the data affected in a real deployment.

Affected products and versions

  • Code-projects Online Product Reservation System, version 1.0
  • Fabian Online Product Reservation System, version 1.0

The record does not list any fixed version.

Exploitation status

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed active exploitation appears in the sources consulted. The record states that a public exploit exists and may be used. The VulDB SSVC data marks exploitation as proof-of-concept level and automatable. The EPSS probability is about 0.435% with a percentile of about 36.76%, which reflects a statistical estimate of exploitation likelihood and not confirmed attacks.

Remediation and mitigation

  • No fix is listed in the available sources, so treat the product as unpatched until the vendor or a maintainer confirms otherwise.
  • Remove the application from internet-facing deployments where it is not required, or restrict access to its administrative paths by network controls and authentication.
  • Ask the developer to replace dynamically built database queries with parameterized queries and to validate the affected inputs on the server side.
  • A web application firewall may reduce risk as a temporary control, but it does not replace a code fix.
  • Review the vendor site at code-projects.org for any update.

Detection guidance

  • Review web server logs for requests to the prod.php path that contain unusual or malformed values in the listed parameters.
  • Watch for database error messages returned to clients and for unexpected changes to product records.
  • Monitor for unusual query volume or data retrieval from the application's database account.

Limitations of the available information

  • The record does not identify the exact vulnerable function or the code change required.
  • No fixed version, vendor advisory or vendor response is listed.
  • Scores differ between providers and scoring systems.
  • The record mentions a public exploit, but this analysis does not reproduce or describe it.
  • Whether real deployments are affected beyond the listed products is unknown.

Frequently asked questions

What is CVE-2026-0576?

It is an SQL injection vulnerability in the prod.php file of code-projects Online Product Reservation System 1.0, reported in the Parameter Handler component.

Can it be exploited remotely?

The record states that the attack can be initiated remotely, and the NVD vector describes network attack without privileges or user interaction.

Is there a fix?

No fixed version is listed in the sources consulted, so the product should be treated as unpatched until the vendor confirms otherwise.

Is it being actively exploited?

It is not listed in CISA's KEV catalog, and no confirmed active exploitation appears in the sources consulted. The record says a public exploit exists.

What should administrators do now?

Restrict or remove internet exposure, limit access to administrative paths, and ask the developer to use parameterized queries and server-side input validation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.