Smartshop SQL Injection Vulnerability in Product.php

A SQL injection vulnerability has been identified in Smartshop version 1.0. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter in 'product.php'. Exploitation of this vulnerability could lead to the extraction of sensitive database information, including usernames and database names.

Impact

Exploitation of this vulnerability allows for arbitrary SQL command execution, which could be used to manipulate the database or extract sensitive information.

Reproduction

To reproduce this vulnerability, send a GET request to 'product.php' with a crafted 'id' parameter that includes a union-based SQL injection payload. The injected SQL code will be executed by the application's database, allowing the attacker to extract sensitive information.