This vulnerability in code-projects Online Shopping System 1.0 allows remote attackers to perform SQL injection by manipulating the proId parameter in the /action.php file. The exact function affected is unspecified. The vulnerability has been publicly disclosed and may be exploited, but no known exploits in the wild have been reported. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and impacts confidentiality, integrity, and availability at a low level.

Successful exploitation could allow an attacker to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access, modification, or denial of service. The impact is rated low by the source, consistent with the CVSS base score of 6.3, reflecting limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, consider applying input validation or web application firewall rules to block malicious proId parameter values.