External risk intelligence

Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-65336

The vulnerability exists in an ecommerce application file intended to display product information. Such applications are designed to be public-facing web services, making the exposed endpoint accessible to internet users by default in standard deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in an e-commerce application, specifically within a file responsible for displaying product prices. This issue allows for unauthorized data manipulation and access. While the specific impact depends on the application's deployment, this type of vulnerability in a public-facing service warrants attention to confirm relevance.

SQL injection allows unauthorized data access.
Critical issue affects public-facing e-commerce applications.
Confirm relevance and exposure to customer data.

Attack Path

How an attacker could exploit the issue

An attacker can target a public-facing e-commerce application by sending a crafted request to a specific PHP file. This file, designed to display product prices, is vulnerable to SQL injection due to how it processes product IDs. Successfully exploiting this could allow an attacker to manipulate the database, leading to significant compromise.

No user authentication required.
Unsanitized product ID input.
Full database control and data compromise.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the `show_price_by_pdtId.php` script could allow an attacker to manipulate database queries when supported by the advisory's context. This could potentially lead to unauthorized access to or modification of sensitive information stored in the application's database.

Database information could be accessed.
Malicious SQL queries could be injected.
Sensitive data could be exposed or altered.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in an e-commerce application's product price display function is likely to be owned by the application team or the platform team responsible for its deployment. The first practical step is to confirm the presence and reachability of this specific application component, identify the accountable business owner, and then assess its criticality to prioritize remediation efforts.

Application or platform team ownership.
Verify affected component reachability.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Fruits Bazar ecommerce project?

Fruits Bazar 1.0 is an ecommerce application built using PHP and MySQLi. It provides a web-based platform for managing an online store, including features for displaying product listings and pricing information to customers.

What does SQL injection mean for CVE-2025-65336?

This vulnerability is classified as CWE-89, meaning the application fails to properly clean user-provided data before using it in database queries. Because the system trusts this input, an attacker can insert their own database commands, potentially allowing them to view, change, or delete the entire contents of the store's database.

How does an attacker trigger this vulnerability?

The flaw exists in the 'show_price_by_pdtId.php' script, which processes product IDs. An attacker triggers the bug by sending a specially crafted request to this file. Importantly, the vulnerability does not require the attacker to have an account or be logged in, as the application processes the malicious input directly through its web interface.

Is my instance of Fruits Bazar at risk?

According to Halo Surface Signal, this vulnerability is likely relevant to your environment because the affected file is part of a public-facing web service. If your instance is accessible over the internet to display prices to users, it is potentially reachable by external attackers who do not need special access to attempt these malicious database queries.

What are the first steps to address this issue?

Start by confirming if your organization uses the Fruits Bazar 1.0 software and whether this specific PHP file is active in your environment. Identify the team responsible for managing the application and verify if it is exposed to the internet. Use this information to prioritize the issue and coordinate with your developers to implement proper input validation, which is necessary to prevent these types of database attacks.

References

github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/ecomme…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.