This vulnerability affects code-projects Online Shopping System version 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the cat_id argument in the /homeaction.php file. The vulnerability allows unauthorized SQL commands to be executed, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. No official remediation or patch is currently documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce the risk of SQL injection attacks.