CVE-2026-14652: SQL Injection in SourceCodester Shopping Cart Admin Login

Technical summary

The vulnerability resides in the admin login handler at /admin/login.php within SourceCodester's shopping cart application. The Username parameter is passed to a database query without proper input validation or parameterized query protection, enabling classic SQL injection. An attacker can craft a malicious username string containing SQL metacharacters (such as single quotes, UNION operators, or boolean logic) to break out of the intended query context and execute arbitrary SQL statements. The attack surface is unauthenticated, network-accessible, and does not require special conditions to trigger.

Business impact

Compromise of the admin login function poses severe business risk. Attackers could gain unauthorized administrative access to the shopping cart system, leading to theft of customer payment information, order data, and PII. Database contents could be exfiltrated, modified, or deleted, disrupting e-commerce operations and triggering regulatory notifications under payment card industry (PCI DSS) and data privacy frameworks. Reputational damage from data breaches and potential financial liability from customer notification requirements create material business exposure.

Affected systems

SourceCodester Simple and Nice Shopping Cart Script version 1.0 is confirmed affected. Organizations running this specific version in production environments—particularly those hosting it on internet-facing servers—face direct exposure. The vulnerability affects the admin login interface, meaning any instance of this software used for administrative access is at risk if left unpatched.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no user interaction, and no special privileges. Network accessibility is direct (CVSS vector AV:N). The absence of complexity requirements (AC:L) and the public availability of exploit information lower the bar for successful attack. A basic SQL injection test on the login form will quickly confirm vulnerability. Automated scanning and exploitation are feasible.

Remediation

The primary remediation is to upgrade to a patched version of the SourceCodester shopping cart script or cease use of version 1.0. If immediate patching is not possible, implement input validation on the username field to reject or sanitize SQL metacharacters, enforce parameterized prepared statements in database queries, and apply Web Application Firewall (WAF) rules to detect and block common SQL injection payloads. Additionally, restrict network access to the /admin/login.php endpoint via IP whitelisting or VPN-only access to limit attack surface.

Patch guidance

Verify the latest available version from SourceCodester and consult their security advisories for specific patch details and upgrade procedures. Apply patches in a controlled testing environment first to validate compatibility with existing configurations, custom modifications, and dependent systems. Given the public nature of the exploit, treat this as a critical priority in your patching cycle.

Detection guidance

Monitor web server access logs for suspicious patterns in requests to /admin/login.php, including unusual characters in the username parameter (quotes, dashes, SQL keywords, UNION operators). Implement intrusion detection signatures to flag SQL injection attempts. Query database transaction logs for unexpected queries initiated from the application layer. Network segmentation monitoring and anomalous database access from the web tier can reveal exploitation in progress. Consider real-time WAF logging to detect injection attempts before they reach the application.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (7.3), unauthenticated network exploitability, public exploit availability, and direct path to admin access and data theft. The combination of confidentiality, integrity, and availability impact (all marked in the CVSS vector) makes it a critical control point for any organization using this software.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects the confluence of attack vector (network), low attack complexity, no privilege or user interaction requirements, and scope unchanged with partial impacts to confidentiality, integrity, and availability. This score appropriately elevates the risk profile due to minimal barriers to exploitation and the sensitivity of the targeted function (admin authentication).

Frequently asked questions