CVE-2026-19921
Received Received - Intake

SQL Injection in Online Shopping System 1.0

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulDB

Description
A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /homeaction.php. Such manipulation of the argument cat_id leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-19921
EUVD
EUVD-2026-59811

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19921 is a SQL Injection vulnerability in the Online Shopping System 1.0. The flaw exists in the file homeaction.php where the cat_id parameter is directly used in an SQL query without sanitization. Attackers can inject malicious SQL code via the cat_id parameter to manipulate database queries.

Detection Guidance

To detect SQL injection vulnerabilities like CVE-2026-19921, monitor HTTP POST requests to /homeaction.php for the cat_id parameter. Use tools like sqlmap to test for SQLi by sending payloads such as 3'and'r'='k and checking for empty responses (Content-Length: 0). Inspect server logs for unusual query patterns or failed database connections.

Impact Analysis

This vulnerability allows remote attackers to extract sensitive data such as user passwords and admin credentials from the database. Attackers can use boolean-based blind SQL injection to test and confirm the exploit, potentially leading to unauthorized access and data breaches.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive personal data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, legal penalties, and reputational damage due to exposure of user credentials and personal information.

Mitigation Strategies

Immediately apply input validation and parameterized queries to sanitize the cat_id parameter in /homeaction.php. Update the application to use prepared statements instead of direct SQL query concatenation. Restrict database user permissions to limit data exposure. Consider deploying a web application firewall (WAF) to filter malicious SQL injection attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart