CVE-2025-11628
BaseFortify
Publication date: 2025-10-12
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jimit105 | project-online-shopping-website | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an SQL injection flaw in the Project-Online-Shopping-Website application, specifically in the /delete.php file of the Product Inventory Handler component. It occurs because the application directly uses the user-supplied 'product_code' parameter in an SQL DELETE statement without proper sanitization. An attacker can manipulate this parameter to alter the SQL query, for example by submitting 'OR '1'='1', which causes the deletion of all records in the products table. The vulnerability can be exploited remotely and requires an enhanced level of authentication. [2, 3]
How can this vulnerability impact me? :
This vulnerability can severely impact the confidentiality, integrity, and availability of the system. An attacker exploiting this flaw can delete all product records from the inventory database, causing data loss and disruption of service. This could lead to operational downtime, loss of business data, and potentially allow further attacks due to compromised system integrity. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /delete.php endpoint of the Project-Online-Shopping-Website for SQL injection via the product_code parameter. One way is to submit SQL injection payloads such as 'OR '1'='1 to the product_code parameter and observe if the SQL query is manipulated (e.g., all products deleted). Additionally, attackers may use Google dorking with queries like inurl:delete.php to identify vulnerable targets. For detection on your system, you can use curl or similar tools to send crafted requests, for example: curl -X POST -d "product_code='OR '1'='1" http://target/delete.php Monitor the response or database changes to confirm vulnerability. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected component with an alternative product, as no vendor patches or mitigations are available. Additionally, restrict access to the /delete.php endpoint to trusted users only, implement input validation and sanitization on the product_code parameter to prevent SQL injection, and consider using web application firewalls (WAF) to block malicious payloads. Monitoring and restricting authentication levels may also help since the vulnerability requires enhanced authentication. [2]