CVE-2026-0578: code-projects Online Product Reservation System delete.php SQL injection
CVE-2026-0578 is a critical SQL injection flaw in the delete.php component of code-projects Online Product Reservation System 1.0, where the ID argument is not handled safely. NVD scores it 9.8 with a vector indicating remote network access and no privileges required. The record lists no fixed version and no CISA KEV listing, but it does reference a public exploit.
Overview
CVE-2026-0578 describes an SQL injection weakness in the delete.php file of the administrative area of code-projects Online Product Reservation System 1.0. According to the record, manipulating the ID argument can change database queries. The weakness is classified as CWE-74 (Injection). Sources: NVD record, VulDB entry.
Impact
- NVD's vector indicates network attack, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact (base score 9.8).
- Successful SQL injection could allow an attacker to read, alter or delete application data, depending on the database permissions in use. This is an inference from the weakness type, not a confirmed outcome.
- VulDB and the CNA publish lower scores in other CVSS versions (for example 6.9 and 5.5), so the severity depends on which scoring source is used.
Affected products and versions
- Code-projects Online Product Reservation System, version 1.0.
- Fabian Online Product Reservation System, version 1.0.
No fixed version is listed in the record. Do not assume a fix exists; verify with the vendor or project maintainers. Project details are available at code-projects.
Exploitation status
The CISA KEV catalog does not list CVE-2026-0578, so this record does not confirm active exploitation in the wild. The VulDB description states that the exploit has been publicly disclosed and may be used, and the references include a public exploit reference. SSVC data in the record marks exploitation as proof-of-concept level. EPSS values are present but their date is later than the publication date, so they should be treated with caution.
Remediation and mitigation
- Restrict access to administrative paths to trusted networks and accounts until the software is reviewed or replaced.
- Remove or disable the affected delete functionality if it is not required.
- Use parameterized queries or prepared statements and strict server-side validation of identifiers, as a secure development practice.
- Apply least-privilege database accounts for the web application.
- Review application code for similar patterns in other administrative endpoints.
Detection guidance
- Review web server and application logs for unusual requests to administrative delete endpoints, especially with malformed or unexpected ID values.
- Monitor database error messages returned to clients, which can indicate injection attempts.
- Alert on spikes in requests to administrative paths from unfamiliar sources.
Limitations of the available information
- The record does not specify which version or build of the product contains the vulnerable code beyond version 1.0.
- No vendor advisory or fixed release is listed.
- The exact affected functionality is described only as unknown functionality of delete.php.
- The relationship between the two listed products is not explained in the record.
Frequently asked questions
Is CVE-2026-0578 being actively exploited?
CISA KEV does not list this CVE, so the record does not confirm active exploitation. A public exploit is referenced, so prioritize access restriction and mitigation.
Is there a fixed version of the affected product?
The record lists no fixed version. Confirm the status with the vendor or project maintainers before assuming a fix exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.