This vulnerability in code-projects Online Shopping System 1.0 allows remote attackers to perform SQL injection by manipulating the total_count parameter in the /checkout_process.php script. The flaw enables unauthorized SQL commands to be executed on the backend database, potentially compromising data integrity and confidentiality. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploit code has been publicly disclosed, increasing the risk of exploitation. No official fix or patch has been announced as of the publication date.

Successful exploitation could allow attackers to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires no privileges, increasing its risk. However, the overall severity is medium, reflecting some limitations in impact or exploit complexity.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisory channels for updates. In the meantime, applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the total_count parameter may help mitigate risk. Avoid exposing the vulnerable endpoint to untrusted networks if possible.