CVE-2026-14767: CodeAstro Ecommerce Website POST Parameter confirm.php sql injection
A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of the component POST Parameter Handler. The manipulation of the argument invoiceno results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In /ecommerce-website-php/customer/confirm.php, ensure the POST parameter invoice_no is not concatenated into SQL statements; validate it and use parameterized (prepared) queries for all database access involving invoice_no.
CodeAstro Ecommerce Website (confirm.php) POST parameter 'invoice_no' handling = Validate and parameterize queries for 'invoice_no' (prevent SQL injection) - Compensating control
Add a compensating control by restricting access to the confirm.php endpoint (e.g., via web server ACL/WAF rules) to reduce exposure of the remotely exploitable SQL injection until the code fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14767?
The severity of CVE-2026-14767 is rated as medium with a score of 6.3.
How do I fix CVE-2026-14767?
To fix CVE-2026-14767, you should sanitize and validate the invoice_no parameter in the confirm.php file to prevent SQL injection.
What type of attack is associated with CVE-2026-14767?
CVE-2026-14767 is associated with SQL injection attacks that can be executed remotely.
Which component is affected by CVE-2026-14767?
CVE-2026-14767 affects the POST Parameter Handler in the confirm.php file of the CodeAstro Ecommerce Website.
What software is impacted by CVE-2026-14767?
CVE-2026-14767 impacts version 1.0 of the CodeAstro Ecommerce Website.