PT-2026-1277 · Unknown · Online Product Reservation System

Ho Cherry · Published 2026-01-05 · Updated 2026-01-09 · CVE-2026-0590

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Online Product Reservation System version 1.0

Description A flaw exists in the Online Product Reservation System that allows for remote manipulation. The issue stems from a SQL injection point within the POST Parameter Handler, specifically in the /app/checkout/delete.php file. The ID argument is susceptible to manipulation, leading to potential SQL injection. The exploit for this issue has been publicly disclosed.

Recommendations Apply updates to address the vulnerability in the affected file /app/checkout/delete.php. Restrict or sanitize the ID parameter to prevent SQL injection attacks. As a temporary workaround, consider disabling the vulnerable function responsible for handling the ID parameter until a patch is available.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-0590

Affected Products

Online Product Reservation System

References · 11

• 🔥 https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_checkout_delete.php.md#poc · Exploit
• 🔥 https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_checkout_delete.php.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0590 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0590 · Vendor Advisory
• https://code-projects.org · Note
• https://twitter.com/CVEnew/status/2008169181825421724 · Twitter Post
• https://vuldb.com/?id.339500 · Note
• https://t.me/cveNotify/148221 · Telegram Post
• https://t.me/CVEtracker/41382 · Telegram Post
• https://vuldb.com/?submit.731128 · Note
• https://vuldb.com/?ctiid.339500 · Note