Zhengxiang

**Name of the Vulnerable Software and Affected Versions** code-projects E-Commerce Website version 1.0 **Description** A flaw exists in code-projects E-Commerce Website 1.0 that allows for SQL injection. The issue is located in the file `/pages/admin account update.php` and involves manipulation of the `user id` argument. This can be exploited remotely. The exploit is publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects E-Commerce Website version 1.0 **Description** A security flaw exists in code-projects E-Commerce Website 1.0. The issue involves the manipulation of the `Search` argument in the file `/pages/admin index search.php`, leading to a SQL injection. This attack can be initiated remotely. The exploit has been publicly released. The vulnerable component is an unknown function within the specified file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Hotel Reservation System version 1.0 **Description** A SQL injection issue exists in the `editroomimage.php` file due to manipulation of the `ID` argument. This can be initiated remotely. The exploit has been publicly disclosed. **Recommendations** As a temporary workaround, consider restricting access to the `editroomimage.php` file until a fix is available. Sanitize the `ID` argument before using it in SQL queries.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Hotel Reservation System version 1.0 **Description** A SQL injection issue exists in the `deleteuser.php` file due to manipulation of the `ID` argument. This can be exploited remotely. The exploit is publicly available. **Recommendations** As a temporary workaround, consider restricting access to the `deleteuser.php` file until a fix is available. Sanitize the `ID` parameter before using it in any database queries.