This vulnerability affects an unspecified functionality in the /homeaction.php file of code-projects Online Shopping System 1.0. By manipulating the cat_id parameter, an attacker can perform SQL injection remotely, potentially leading to unauthorized data access or modification. The vulnerability is identified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Although exploit code is publicly available, there is no evidence of active exploitation in the wild. No patch or remediation information is provided in the available data.

Successful exploitation could lead to unauthorized disclosure, modification, or destruction of data within the affected system due to SQL injection. The CVSS vector indicates low privileges required and no user interaction needed, with impacts on confidentiality, integrity, and availability rated as low. However, the overall severity is assessed as low by the source database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries to mitigate SQL injection risks. Monitor vendor channels for updates and patches addressing this vulnerability.