CVE-2025-11628
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-12

Last updated on: 2026-04-29

Assigner: VulDB

Description
A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file /delete.php of the component Product Inventory Handler. This manipulation of the argument product_code causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-12
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2025-10-12
EPSS Evaluated
2026-06-14
NVD
CVE-2025-11628
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
jimit105 project-online-shopping-website *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection flaw in the Project-Online-Shopping-Website application, specifically in the /delete.php file of the Product Inventory Handler component. It occurs because the application directly uses the user-supplied 'product_code' parameter in an SQL DELETE statement without proper sanitization. An attacker can manipulate this parameter to alter the SQL query, for example by submitting 'OR '1'='1', which causes the deletion of all records in the products table. The vulnerability can be exploited remotely and requires an enhanced level of authentication. [2, 3]

Impact Analysis

This vulnerability can severely impact the confidentiality, integrity, and availability of the system. An attacker exploiting this flaw can delete all product records from the inventory database, causing data loss and disruption of service. This could lead to operational downtime, loss of business data, and potentially allow further attacks due to compromised system integrity. [2]

Detection Guidance

This vulnerability can be detected by testing the /delete.php endpoint of the Project-Online-Shopping-Website for SQL injection via the product_code parameter. One way is to submit SQL injection payloads such as 'OR '1'='1 to the product_code parameter and observe if the SQL query is manipulated (e.g., all products deleted). Additionally, attackers may use Google dorking with queries like inurl:delete.php to identify vulnerable targets. For detection on your system, you can use curl or similar tools to send crafted requests, for example: curl -X POST -d "product_code='OR '1'='1" http://target/delete.php Monitor the response or database changes to confirm vulnerability. [2, 3]

Mitigation Strategies

Immediate mitigation steps include replacing the affected component with an alternative product, as no vendor patches or mitigations are available. Additionally, restrict access to the /delete.php endpoint to trusted users only, implement input validation and sanitization on the product_code parameter to prevent SQL injection, and consider using web application firewalls (WAF) to block malicious payloads. Monitoring and restricting authentication levels may also help since the vulnerability requires enhanced authentication. [2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart