CVE Alert: CVE-2025-12215 – projectworlds – Online Shopping System
CVE-2025-12215
HIGHNo exploitation known
A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS v3.1 (7.3)
Vendor
projectworlds
Product
Online Shopping System
Versions
1.0
CWE
CWE-89, SQL Injection
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Published
2025-10-27T04:02:12.489Z
Updated
2025-10-27T04:02:12.489Z
References
AI Summary Analysis
Risk verdict
Why this matters
Most likely attack path
Who is most exposed
Detection ideas
- Unusual values or payloads in the keywords parameter of login requests.
- Database error messages or stack traces appearing in application logs.
- spikes in failed logins or anomalous authentication activity to the login endpoint.
- HTTP requests containing SQLi-like patterns (e.g., tautologies, UNION SELECT).
- WAF/IDS alerts triggered by SQL injection signatures.
Mitigation and prioritisation
- Apply the vendor patch or upgrade to a fixed version; if unavailable, implement prepared statements/parameterised queries and input validation.
- Harden database access: least-privilege credentials, disable verbose DB errors, and enforce strict input sanitisation.
- Deploy WAF rules to block SQLi patterns; monitor and alert on anomalous login activity.
- Change-management: test in staging, schedule rapid production rollout, verify functionality, and inform users of potential impacts.
- Establish ongoing monitoring of login endpoints and enable rapid rollback if issues arise.
Support Our Work
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
AI APIs OSINT driven New features
