CVE Intelligence
Analysis AI-assisted

CVE-2026-0592: code-projects Online Product Reservation System SQL injection in User Registration

CVE-2026-0592 describes an SQL injection flaw in the User Registration handler of code-projects Online Product Reservation System 1.0. The record links it to register_code.php and says that several registration fields can be manipulated remotely. NVD scores it 9.8 (critical), no fix is listed in the sources, and CISA KEV does not list it.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an SQL injection flaw in the User Registration handler of code-projects Online Product Reservation System 1.0. The affected file is /handgunner-administrator/register_code.php, and the description says that the fname, lname, address, city, province, country, zip, tel_no, email and username arguments can be manipulated to produce SQL injection. The record classifies the weakness as CWE-74 (Injection). Details are taken from the NVD entry and the CVE Record.

Impact

  • NVD scores the issue 9.8 under CVSS with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. This is the confirmed NVD score in the record.
  • Other scores in the record, from VulDB and other providers, range from 5.5 to 7.5. The scores differ by provider and method, so the critical rating should be read with that in mind.
  • The SSVC data in the record marks the issue as automatable, with partial technical impact.
  • The practical consequences of successful SQL injection depend on the database permissions and the application deployment, which the record does not describe.

Affected products and versions

  • The record lists Code-projects Online Product Reservation System, version 1.0.
  • The record also lists Fabian Online Product Reservation System, version 1.0.
  • No other versions are listed in the record. Whether later or earlier releases are affected is unknown from the available data.

Exploitation status

  • The description states that an exploit has been released to the public and may be used for attacks. A third-party reference tagged as an exploit is included in the record.
  • CISA KEV does not list this CVE in the record, so it is not confirmed as exploited in the wild by that catalog.
  • No confirmed active exploitation appears in the sources consulted. The SSVC exploitation value in the record is 'poc', which indicates proof-of-concept availability.

Remediation and mitigation

  • The record lists no fixed version. The absence of a listed fix does not mean that no fix exists, so the status should be checked with the vendor or project maintainer and the code-projects website.
  • Restrict access to the registration component and the administrator path until the code is reviewed, especially if the application is exposed to the internet.
  • Review the code so that all database queries use parameterized statements and that input is validated server-side. This is a general defensive measure and not a fix confirmed by the sources.
  • Consider a web application firewall as a temporary compensating control, recognizing that it may not block all variants.

Detection guidance

  • Review web server logs for unusual or repeated requests to register_code.php, especially requests with abnormal lengths or unexpected characters in the registration fields.
  • Monitor database logs and application errors for SQL syntax errors originating from the registration flow.
  • Audit recently created user accounts for entries with unexpected content in the name, address, email or username fields.

Limitations of the available information

  • The record does not identify the exact vulnerable function, the database engine, the authentication requirements of the registration process, or the presence of any official patch.
  • The EPSS values in the record (probability 0.00441, percentile 0.37268) are estimates and do not confirm exploitation.
  • Scores from different providers conflict, and the record does not explain the reasons for the differences.

Frequently asked questions

What is CVE-2026-0592?

It is a reported SQL injection flaw in the User Registration handler of code-projects Online Product Reservation System 1.0, in the file register_code.php.

How severe is it?

NVD scores it 9.8 (critical). Other providers in the record score it between 5.5 and 7.5.

Is it being actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The description says a public exploit has been released.

Is there a fixed version?

The record does not list a fixed version. Check with the project maintainer or vendor before assuming a fix exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.