This vulnerability affects code-projects Online Shopping System 1.0. An attacker can exploit improper input validation of the cat_id parameter in the /homeaction.php file to perform SQL injection attacks remotely. This could allow unauthorized access or modification of the database. The vulnerability is identified as CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Public exploit code exists, but no vendor patch or fix has been confirmed.

Successful exploitation could allow an attacker with network access to inject malicious SQL commands via the cat_id parameter, potentially leading to unauthorized data access or manipulation. The CVSS 3.1 base score is 5.3 (medium severity), indicating a moderate risk with network attack vector, low privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the cat_id parameter. Review and sanitize all inputs to the /homeaction.php endpoint if possible.