CVE-2026-0579 Enables Remote SQL Injection in Online Product Reservation System
Public exploit allows attackers to manipulate backend databases via administrative functions
Severity
MEDIUM–HIGH — Remote SQL Injection With Public Exploit
When
Published: 04 Jan 2026
Last Updated: 03 Jan 2026
Technical Overview
Security researchers have disclosed CVE-2026-0579, a SQL injection vulnerability affecting code-projects Online Product Reservation System version 1.0.
The vulnerability exists in the administrative edit functionality, where backend logic fails to properly sanitize POST parameters. An attacker can remotely manipulate input fields to inject malicious SQL queries. The flaw does not require authentication and is exploitable over the network.
Public proof-of-concept exploit code is available, which significantly increases the likelihood of real-world abuse.
Exploitation Details
Attackers can exploit the vulnerability by sending crafted POST requests to the administrative edit endpoint. The affected parameters include product identifiers and metadata fields commonly used during product modification.
Because the system does not validate or sanitize these inputs, attackers can directly interact with the backend database. This weakness enables automated exploitation and scanning across exposed installations.
Risk Assessment
- CVSS v2 Score: 7.5 (High)
- CVSS v3.1 Score: 7.3 (High)
- CVSS v4.0 Score: 6.9 (Medium)
Although CVSS v4 rates the vulnerability as medium, the presence of a public exploit and remote attack vector raises the practical risk level.
Potential Impact
Successful exploitation may allow attackers to:
- Read sensitive database records
- Modify or delete product information
- Extract administrative or operational data
- Prepare follow-on attacks against connected systems
Organizations running vulnerable systems should assume active scanning and exploitation attempts.
Key Risk
- Public exploit lowers attack complexity
- No authentication required
- SQL injection enables deep backend compromise
- Administrative functions often expose critical data
Recommended Defensive Actions
- Upgrade or patch the Online Product Reservation System immediately
- Restrict access to administrative interfaces
- Apply server-side input validation and parameterized queries
- Deploy WAF rules to block SQL injection attempts
- Review logs for suspicious POST requests to admin endpoints