CVE-2026-0583: code-projects Online Product Reservation System SQL injection in User Login login.php
A SQL injection flaw has been reported in the User Login component of code-projects Online Product Reservation System 1.0, in app/user/login.php, through the emailadd argument. The record states the attack may be launched remotely and that a public exploit has been released, and the NVD base score is 9.8 (critical). The sources consulted show no confirmed exploitation in the wild and no fixed version is listed.
Overview
The record describes an SQL injection weakness (listed under CWE-74, Injection) in the user login script app/user/login.php of code-projects Online Product Reservation System 1.0. The affected input is the emailadd argument. Details are summarized in the NVD entry and the VulDB entry.
Impact
- The NVD vector in the record lists high impact on confidentiality, integrity and availability.
- The record does not describe which data or tables could be reached, so the practical reach depends on the database behind the login logic, which is unknown from the available data.
- Successful injection in a login flow can allow an unauthenticated remote party to influence database queries.
Affected products and versions
- Code-projects Online Product Reservation System, version 1.0 (vendor site).
- The record also lists a product named Fabian Online Product Reservation System with the same version 1.0 entry.
- No fixed version is listed. An empty fix list does not prove that no fix exists.
Exploitation status
- The record does not list this CVE in CISA KEV, so active exploitation is not confirmed by that source.
- The record states that an exploit has been released to the public and may be used for attacks.
- The record's SSVC data lists exploitation as proof of concept and the record marks the issue as automatable.
- The EPSS probability is 0.00441 with a percentile of 0.37267, as reported in the record.
- No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Identify any deployment of this application, including forks or copies of the same code, and treat them as in scope.
- Until an authoritative fix is confirmed, restrict access to the login endpoint, place it behind network controls or a web application firewall, and limit exposure to trusted networks where feasible.
- For maintainers, use parameterized queries or prepared statements for all database access in the login flow and validate input server-side.
- Review database account privileges used by the application and apply least privilege.
- If compromise is suspected, rotate credentials and review account and data integrity.
Detection guidance
- Review web server and application logs for login requests with unusual or malformed values in the emailadd field.
- Watch for database errors originating from the login component and for bursts of failed logins from single sources.
- Monitor for unexpected changes to user records or unexpected database queries from the application account.
Limitations of the available information
- The record does not provide the exact vulnerable code, a vendor statement, or a fixed release.
- Scores differ by provider; the NVD base score is 9.8 while other providers' scores in the record range from 5.5 to 7.5.
- The findings were not verified by testing in this analysis.
Frequently asked questions
Is CVE-2026-0583 being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been released, so the risk of exploitation is considered elevated.
Which product and component are affected?
The record names code-projects Online Product Reservation System 1.0, in the User Login component at app/user/login.php, where the emailadd argument is involved.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.