CVE-2026-14767 is a SQL injection vulnerability affecting CodeAstro Ecommerce Website 1.0. The flaw exists in the POST parameter handler for the invoice_no argument in the /ecommerce-website-php/customer/confirm.php component. An attacker can remotely exploit this vulnerability by manipulating the invoice_no parameter to inject SQL commands. The vulnerability has been publicly disclosed with exploit code available, increasing the risk of attack. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to intermediate impact on confidentiality, integrity, and availability. No official remediation or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium, reflecting partial compromise of confidentiality, integrity, and availability. Since the exploit is publicly available, the risk of attack is elevated despite no current reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and parameterized queries for the invoice_no parameter to mitigate SQL injection risks. Monitor for updates from CodeAstro regarding patches or official mitigations.