CVE Intelligence
Analysis AI-assisted

CVE-2026-0591: code-projects Online Product Reservation System SQL injection in cart update handler

A SQL injection flaw (CWE-74) in the cart update handler of code-projects Online Product Reservation System 1.0 can be triggered remotely. NVD lists a base score of 9.8, and the record states that a public exploit is available. No fixed version is listed in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an SQL injection flaw in the cart update handler of code-projects Online Product Reservation System 1.0. The affected file is /app/checkout/update.php, and the record classifies the weakness as CWE-74 (Injection).

Impact

  • The record's vector indicates high impact on confidentiality, integrity and availability, with network attack vector and no privileges or user interaction required.
  • A successful injection could let a remote party influence database queries, which may expose or alter stored data. This is an inference from the vulnerability class and the scoring, not a tested outcome.

Affected products and versions

  • Code-projects Online Product Reservation System, version 1.0.
  • Fabian Online Product Reservation System, version 1.0, also listed in the record.
  • No other versions are listed in the sources consulted.

Exploitation status

  • The record states that a public exploit is available and might be used.
  • The record shows this CVE is not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted.
  • The SSVC data in the record gives exploitation as proof of concept and automatable as no.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix is unknown status, not proof that no fix exists.
  • Check the project and vendor sources for a patched release or an official statement.
  • Until a fix is confirmed, restrict access to the application, limit internet exposure where possible, and review whether checkout components are reachable.
  • If the code is maintained by your team, apply input validation and parameterized queries in the checkout logic.

Detection guidance

  • Review web server and application logs for unusual requests to the checkout update endpoint, especially malformed or unexpected values in cart update parameters.
  • Watch for database error messages returned to clients, which can indicate query manipulation attempts.
  • Confirm whether your deployed copy matches the affected version 1.0.

Limitations of the available information

  • The record does not describe the vulnerable code in detail.
  • The record does not confirm a fix or a patched version.
  • The record does not describe which database tables or data would be affected.
  • The EPSS probability in the record is 0.00367, which does not offset the high base score or the presence of a public exploit.

Frequently asked questions

Which versions are affected by CVE-2026-0591?

The record lists code-projects Online Product Reservation System version 1.0 and Fabian Online Product Reservation System version 1.0. No other versions are listed in the sources consulted.

Is this vulnerability being actively exploited?

The record states that a public exploit is available, but it does not list this CVE in CISA KEV. No confirmed active exploitation appears in the sources consulted.

Is there a fix for this issue?

No fixed version is listed in the record. Check the project and vendor sources for a patch, and restrict access to the application until a fix is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.