PT-2026-1277 · Unknown · Online Product Reservation System

Ho Cherry · Publicado 2026-01-05 · Atualizado 2026-01-09 · CVE-2026-0590

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Online Product Reservation System version 1.0

Description A flaw exists in the Online Product Reservation System that allows for remote manipulation. The issue stems from a SQL injection point within the POST Parameter Handler, specifically in the /app/checkout/delete.php file. The ID argument is susceptible to manipulation, leading to potential SQL injection. The exploit for this issue has been publicly disclosed.

Recommendations Apply updates to address the vulnerability in the affected file /app/checkout/delete.php. Restrict or sanitize the ID parameter to prevent SQL injection attacks. As a temporary workaround, consider disabling the vulnerable function responsible for handling the ID parameter until a patch is available.

Exploit

Correção

Special Elements Injection

SQL injection

Enumeração de Fraquezas

CWE-74

CWE-89

Identificadores relacionados

CVE-2026-0590

Produtos afetados

Online Product Reservation System

Referências · 11

• 🔥 https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_checkout_delete.php.md#poc · Exploit
• 🔥 https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_checkout_delete.php.md · Exploit
• https://code-projects.org · Nota
• https://twitter.com/CVEnew/status/2008169181825421724 · Publicação no Twitter
• https://vuldb.com/?id.339500 · Nota
• https://t.me/cveNotify/148221 · Publicação no Telegram
• https://t.me/CVEtracker/41382 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-0590 · Nota de Segurança
• https://vuldb.com/?submit.731128 · Nota
• https://vuldb.com/?ctiid.339500 · Nota
• https://osv.dev/vulnerability/CVE-2026-0590 · Aviso do Fabricante