CVE-2026-85643: SQL Injection in code-projects Online Shopping System

CVE-2026-85643 describes a SQL injection vulnerability in code-projects Online Shopping System version 1.0. The issue arises from improper sanitization of the 'mobile' parameter in the admin/adduser.php file's mysqli_query function, allowing an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and limited impact on confidentiality, integrity, and availability. An exploit has been published, but no active exploitation is confirmed.

Successful exploitation of this vulnerability allows an attacker to perform SQL injection attacks remotely by manipulating the 'mobile' parameter. This can lead to unauthorized database queries, potentially exposing or altering sensitive data. The impact is rated medium based on the CVSS score and vector, indicating limited but significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a patch is available, restricting access to the affected functionality and validating or sanitizing input parameters may reduce risk.