Code-Projects Online Shoe Store SQL Injection Vulnerability

A critical SQL injection vulnerability has been identified in Code-Projects Online Shoe Store version 1.0. The issue arises in the file '/details.php', where the 'id' parameter is processed without proper validation or sanitization, allowing remote attackers to manipulate the input and execute arbitrary SQL commands. This vulnerability could lead to unauthorized access to the application's database or even remote code execution.

Impact

Exploitation of this vulnerability allows for SQL injection, with the potential to access or manipulate database information. According to the vulnerability disclosure, this could also lead to remote code execution.

Reproduction

To reproduce this vulnerability, send a request to the '/details.php' endpoint with a crafted 'id' parameter that includes SQL injection payloads. The absence of input validation will allow the injection to be executed, manipulating the SQL query to access or modify database information.