PT-2026-21868 · Sourcecodester · Simple/Nice Shopping Cart Script

Xiaosun · Published 2026-02-25 · Updated 2026-03-02 · CVE-2026-3148

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Simple and Nice Shopping Cart Script version 1.0

Description A SQL injection issue exists in SourceCodester Simple and Nice Shopping Cart Script 1.0. The issue is located in an unknown function within the /signup.php file. Manipulating the Username argument can trigger the SQL injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Recommendations Apply any available updates or patches for version 1.0. As a temporary workaround, sanitize the Username input to prevent SQL injection. Restrict access to the /signup.php file if possible.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-3148

Affected Products

Simple/Nice Shopping Cart Script

References · 13

• 🔥 https://github.com/xiaoxiaojie12/CVE/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2026-3148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3148 · Security Note
• https://sourcecodester.com · Note
• https://t.me/cveNotify/153105 · Telegram Post
• https://vuldb.com/?ctiid.347654 · Note
• https://twitter.com/RedPacketSec/status/2026537186800148804 · Twitter Post
• https://twitter.com/CVEnew/status/2026641346618925508 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026696530359407041 · Twitter Post
• https://vuldb.com/?id.347654 · Note
• https://vuldb.com/?submit.758822 · Note
• https://twitter.com/cracbot/status/2028425221594857811 · Twitter Post
• https://t.me/CVEtracker/45696 · Telegram Post