CVE-2025-65336 in Fruits-Bazar
Summary
by MITRE • 07/30/2026
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
The ecommerce project Fruits Bazar version 1.0 presents a critical security vulnerability through SQL injection in the show_price_by_pdtId.php component. This flaw allows malicious actors to manipulate database queries by injecting arbitrary SQL code through input parameters, potentially compromising the entire backend database infrastructure. The vulnerability specifically manifests when user-supplied product identifiers are directly incorporated into SQL statements without proper sanitization or parameterization mechanisms.
This security weakness falls under the common weakness enumeration CWE-89 which categorizes improper neutralization of special elements used in SQL commands as a primary cause of SQL injection vulnerabilities. The attack vector exploits the lack of input validation and secure coding practices within the application's data handling procedures, particularly in how product identifiers are processed and executed against the database layer. The vulnerability enables unauthorized access to sensitive customer information, transaction records, and inventory data that may be stored within the same database system.
The operational impact of this vulnerability extends beyond simple data theft, potentially allowing attackers to escalate privileges, modify or delete critical business data, and even gain shell access to underlying server systems. Database administrators and security teams face significant risk as this flaw could lead to complete system compromise if exploited effectively. The nature of the vulnerability suggests that any user interaction with product price display functionality could serve as an entry point for malicious activity, making it particularly dangerous in production environments where customer data is continuously processed.
Mitigation strategies should focus on implementing proper input validation and parameterized queries throughout the application codebase. The recommended approach includes utilizing prepared statements with bound parameters instead of direct string concatenation, implementing comprehensive input sanitization routines, and establishing proper database user permissions to minimize potential damage from successful exploitation attempts. Additionally, regular security audits and penetration testing should be conducted to identify similar vulnerabilities across other components of the ecommerce platform, ensuring compliance with industry standards such as those outlined in the OWASP Top Ten project and NIST cybersecurity frameworks for web application security.