The code-projects Online Shopping System 1.0 contains a SQL injection vulnerability in an unknown function of the /action.php file. This vulnerability arises from improper sanitization or validation of the proId parameter, enabling remote attackers to inject SQL commands. The vulnerability is remotely exploitable and has been publicly disclosed. There is no vendor-provided patch or official remediation information at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database with limited privileges, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no user interaction, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall rules to block malicious proId parameter values as a temporary mitigation.