CVE-2025-51968
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A SQL Injection vulnerability exists in action.php of PuneethReddyHC Online Shopping System Advanced 1.0. The application fails to properly sanitize the 'proId' POST parameter, allowing attackers to inject arbitrary SQL expressions.
Risk Assessment
An attacker can gain unauthorized access to the database, steal, modify, or delete data, potentially leading to confidentiality and integrity breaches.
Recommendation
Use parameterized queries or prepared statements in action.php. Additionally, validate and sanitize all input data.
Other vulnerabilities in PuneethReddyHC Online Shopping System
See all- CVE-2025-51972Medium
A SQL Injection vulnerability exists in login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of the 'keyword' POST parameter.
- CVE-2025-51969Medium
A SQL Injection vulnerability exists in product.php of PuneethReddyHC Online Shopping System Advanced 1.0. The 'product_id' GET parameter is not properly validated before being included in a SQL statement.
Original NVD description (English source)
A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The application fails to properly sanitize user-supplied input in the proId POST parameter, allowing attackers to inject arbitrary SQL expressions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS