CVE-2025-15409 Details

A SQL injection vulnerability exists in the file Delete_product.php of the Code-Projects Online Guitar Store version 1.0. The issue arises because the del_pro parameter is manipulated, allowing attackers to inject malicious SQL code. This unsanitized input is directly used in SQL queries, enabling unauthorized data access and manipulation. The vulnerability can be exploited remotely without authentication.

To address this vulnerability, it is recommended to use prepared statements and parameter binding to prevent SQL injection. Additionally, input validation and filtering should be implemented to ensure that user input meets expected formats, blocking malicious data. Finally, database user permissions should be minimized, ensuring that the account used for database connections has only the necessary privileges.