CVE-2025-26156 Details
Description
A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter.
A SQL injection vulnerability has been identified in the PHPGurukul Online Shopping Portal version 2.1, specifically within the track-orders.php file. This vulnerability allows remote attackers to execute arbitrary SQL commands by injecting payloads into the orderid POST request parameter. The issue arises from inadequate input validation, enabling attackers to manipulate SQL queries and potentially execute malicious code on the server.
It is recommended to use prepared statements or parameterized queries to prevent SQL injection. Additionally, user inputs should be sanitized and validated, and a web application firewall (WAF) can be implemented to add an extra layer of security. Regular updates and patches to the application are also advised.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/README.md | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/README.md | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| phpgurukul online shopping portal project | 2.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2025 | Initial Analysis | [email protected] |
| Feb 14, 2025 | CVE Modified | CISA-ADP |
| Feb 14, 2025 | New CVE Received | [email protected] |