CVE-2026-85643: Online Shopping System 1.0 SQLi Vulnerability

CVE-2026-85643 Overview

CVE-2026-85643 is a SQL injection vulnerability in code-projects Online Shopping System 1.0. The flaw resides in the mysqli_query call within admin/adduser.php, where the mobile parameter is passed to the database without proper sanitization. An authenticated remote attacker with administrative privileges can manipulate the mobile argument to inject arbitrary SQL statements. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed instances. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Successful exploitation allows attackers to read, modify, or delete data in the backing MySQL database through the administrative user-add workflow.

Affected Products

code-projects Online Shopping System 1.0
Vulnerable file: admin/adduser.php
Vulnerable sink: mysqli_query invocation processing the mobile parameter

Discovery Timeline

2026-09-04 - CVE-2026-85643 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85643

Vulnerability Analysis

The vulnerability exists in the administrative user creation flow of code-projects Online Shopping System 1.0. When an administrator submits the add-user form, admin/adduser.php concatenates the mobile request parameter directly into a SQL statement executed via mysqli_query. Because the value is not parameterized or escaped, attacker-controlled SQL fragments are treated as part of the query. The attack is remotely reachable over the network, but requires high privileges since access to admin/adduser.php is restricted to authenticated administrators. A working exploit has been published, per the referenced GitHub CVE-1 Vulnerability Report.

Root Cause

The root cause is missing input neutralization on the mobile POST parameter before it is embedded in the SQL statement passed to mysqli_query. The code relies on string concatenation instead of prepared statements with bound parameters, so any characters with SQL meaning are interpreted literally by the database engine.

Attack Vector

An authenticated administrator submits a crafted mobile value through the add-user form. The injected payload closes the intended string literal and appends attacker-chosen clauses such as UNION SELECT statements or boolean-based inference conditions. Depending on database privileges, an attacker can extract records from other tables, modify user accounts, or corrupt data used by the storefront.

No verified proof-of-concept code is reproduced here. Refer to the VulDB entry for CVE-2026-85643 and the linked GitHub report for exploit details.

Detection Methods for CVE-2026-85643

Indicators of Compromise

HTTP POST requests to admin/adduser.php containing SQL metacharacters such as single quotes, UNION, SLEEP(, or comment sequences (--, #) inside the mobile field.
Unexpected new administrator accounts or modified rows in the users table shortly after add-user form submissions.
MySQL error log entries referencing syntax errors originating from queries invoked by adduser.php.

Detection Strategies

Enable web server access logging and alert on admin/adduser.php POST bodies containing SQL keywords in the mobile parameter.
Deploy a web application firewall rule that inspects the mobile field for SQL injection patterns and blocks or tags matching requests.
Correlate authentication logs with add-user submissions to identify administrator sessions issuing anomalous payloads.

Monitoring Recommendations

Monitor MySQL general or audit logs for queries originating from the application user that contain multiple statements, UNION SELECT, or time-based functions.
Track row-count deltas on the users and privilege tables to catch unauthorized inserts or updates.
Alert on administrator session activity from unfamiliar IP addresses or user agents.

How to Mitigate CVE-2026-85643

Immediate Actions Required

Restrict network access to the admin/ directory using IP allow-lists or VPN-only reachability until a code fix is deployed.
Rotate credentials for all administrator accounts and audit the users table for unauthorized entries.
Reduce the MySQL account privileges used by the application to the minimum required for normal operations.

Patch Information

No official vendor patch has been published in the referenced advisories. Operators should treat the codebase as vulnerable and apply source-level remediation by replacing the concatenated query in admin/adduser.php with a prepared statement using mysqli_prepare and bind_param, validating that mobile matches an expected numeric format before database submission.

Workarounds

Place a web application firewall in front of the application with SQL injection signatures enabled for admin endpoints.
Add server-side input validation that rejects any mobile value containing non-digit characters before it reaches the database layer.
Disable or remove the adduser.php endpoint in production if administrator provisioning is not required through the web interface.

bash

# Example nginx configuration to restrict admin access to trusted networks
location /admin/ {
    allow 10.0.0.0/24;
    deny all;
}