CVE-2025-11596 is a high severity SQL injection flaw (CVSS 7.3) in code-projects E-Commerce Website 1.0, reached through the order_id argument in /pages/delete_order_details.php. No fixed version is confirmed in the sources reviewed. Take the app off the public internet, replace the query with a prepared statement, and check the vendor for updates.
What's affected
- Product: code-projects E-Commerce Website
- Affected: version 1.0
- Weak point: the order_id argument handled by /pages/delete_order_details.php
- Fixed version: none confirmed. The researcher report linked below describes the flaw and does not point to a patched release, so treat every deployment of this version as exposed until the vendor says otherwise
The record describes the issue as remote, and the CVSS base score is 7.3 (HIGH). The CVSS vector says no account is needed, so anyone who can reach the page over the network is in scope.
The weakness is classified as CWE-89 (SQL injection) and its parent category CWE-74 (injection). Neither is specific to this product. They describe the same coding mistake, which is building a database query out of text the user controls.
How to check if you're exposed
There is no package to query here, so the check is about inventory and code review.
Start with inventory. Ask whoever deployed E-Commerce Website whether it exists anywhere in your estate, including test servers and old demo hosts. Hobby grade apps like this tend to be forgotten rather than retired.
Then review the code. In /pages/delete_order_details.php, find where the order_id argument enters a database call. A query built by joining strings is the red flag.
grep -rn "order_id" /path/to/app
Finally, review access logs for /pages/delete_order_details.php with unusual characters in the order_id value. The command below is a starting point, and your log path may differ.
grep -iE "union|select|sleep|%27" /var/log/nginx/access.log | grep "delete_order_details.php"
What to do now
- Decide whether you need this app at all. If it is a demo or a learning project, shut it down and remove it from the server.
- If you must keep it running, restrict access. Put it behind a VPN, an IP allow list or HTTP authentication so it is not reachable by the open internet.
- Fix the query in /pages/delete_order_details.php. Replace string concatenation with a prepared statement and bind order_id as a value. The pattern looks like this, with names changed to match your schema.
$stmt = $pdo->prepare("SELECT * FROM items WHERE id = :id");
$stmt->execute([':id' => $value]);
- Give the database account the app uses only the permissions it needs. An account that cannot drop tables or read other schemas limits the damage of any injection.
- Watch the vendor page and the researcher issue for a patched release, and review the advisory before you rely on one. No fixed version is confirmed here.
- Add the app to your dependency and code scanning so the next flaw in it does not wait for a headline.
Why it matters
Flaws like this are old and well understood, yet they keep appearing in small PHP and Java projects that people download and deploy as is. The cause is a single habit. The code pastes the order_id argument straight into a query instead of passing it as a bound value.
The record notes that an exploit is public, and the weakness can be reached remotely. It is not on the CISA Known Exploited Vulnerabilities list, and we found no statement that it is being used in attacks. The practical risk is to whatever the application stores. Typically that means user accounts, orders or records the app keeps in its database, and the CVSS impact ratings of low confidentiality, low integrity and low availability reflect that.
Treat one reported parameter as a hint, not a boundary. Review every place the app builds a query from request data, not only the one in the CVE.
Quick check
Is there a patched version of E-Commerce Website?
No fixed version is confirmed in the record or the report we reviewed. Check the vendor site and the project issue before relying on any update, and fix the query yourself if the source is under your control.
Is CVE-2025-11596 being exploited in the wild?
The record says an exploit is publicly available, but it is not in the CISA Known Exploited Vulnerabilities catalog and no source we reviewed reports attacks. Act as if scanning is likely.
Sources
- Researcher issue and write up
- CVE record and CVSS vector for CVE-2025-11596, as published on 2025-10-11
Last reviewed: 19 October 2026.
