CVE-2026-0585: code-projects Online Product Reservation System SQL Injection in order_view.php
CVE-2026-0585 is an SQL injection flaw in the order_view.php file of code-projects Online Product Reservation System 1.0, triggered through the transaction_id GET parameter. The NVD record rates it critical, and the description states that a public exploit has been disclosed. No confirmed exploitation in the wild appears in the sources consulted, and no fixed version is listed.
Overview
CVE-2026-0585 is an SQL injection vulnerability in the order_view.php file of code-projects Online Product Reservation System 1.0. The flaw is reachable through the transaction_id GET parameter and is classified under CWE-74 (Injection). The record was published on 2026-01-05, with VulDB as the CNA.
Impact
SQL injection in a web application can allow an attacker to influence database queries, which may expose, alter or delete stored data depending on the database configuration and the privileges of the application account. The NVD CVSS base score is 9.8, and its vector rates confidentiality, integrity and availability impact as high. VulDB scores in the record are lower, between 5.5 and 7.3, so the severity depends on which assessment is used. The SSVC data in the record rates the technical impact as partial.
Affected products and versions
- The record lists Code-projects Online Product Reservation System, version 1.0.
- The record also lists Fabian Online Product Reservation System, version 1.0.
- No fixed version is listed. This does not confirm that no fix exists, so the remediation status is unknown.
Exploitation status
The record states that the exploit has been publicly disclosed and may be used. The CISA KEV catalog entry in the record is not listed, so no confirmed active exploitation is reported in the sources consulted. The SSVC exploitation field is set to proof of concept. The EPSS probability is 0.00441 with a percentile of 0.37268.
Remediation and mitigation
- Identify any deployment of this application and check whether it is reachable from untrusted networks.
- Restrict access to the affected application until the maintainer provides a corrected version or the code has been reviewed and hardened.
- Use parameterized queries or prepared statements for all database access in order_view.php, and validate transaction_id on the server side.
- Limit the database privileges granted to the web application account.
- Check the product website and the VulDB entry for updates.
Detection guidance
- Review web server and application logs for requests to order_view.php with unexpected or non-numeric transaction_id values.
- Look for database error messages returned to clients, which can indicate that malformed input reaches queries.
- Monitor for unusual database activity originating from the web application account.
- A web application firewall rule may serve as a temporary compensating control, but it should be tested to limit false positives.
Limitations of the available information
The record does not provide a fixed version, a vendor patch, a detailed root cause in the affected code, or confirmed exploitation data. The description names the component as GET Parameter Handler and calls the affected function unknown. The scores come from different providers and scoring system versions and should not be averaged. The inclusion of the Fabian product is taken from the record as stated.
Frequently asked questions
Is CVE-2026-0585 being actively exploited?
The record states that a public exploit has been disclosed, but the CVE is not listed in CISA KEV in the record. No confirmed exploitation in the wild appears in the sources consulted.
Which versions are affected?
The record lists version 1.0 of the code-projects Online Product Reservation System and version 1.0 of the Fabian Online Product Reservation System. No fixed version is listed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.