Code-Projects Online Shoe Store SQL Injection Vulnerability in summary.php

A critical SQL injection vulnerability has been identified in Code-Projects Online Shoe Store version 1.0. The issue resides in the summary.php file, where the tid parameter is manipulated, allowing attackers to inject malicious SQL queries. This vulnerability can be exploited remotely, potentially leading to unauthorized access to the application's database or even remote code execution.

Impact

Exploitation of this vulnerability allows for SQL injection, with potential consequences of unauthorized database access and remote code execution.

Reproduction

The vulnerability can be reproduced by sending a request to the summary.php file with a crafted tid parameter that includes malicious SQL code. This can be done using a tool like sqlmap, which can automate the process of exploiting SQL injection vulnerabilities.