CVE-2023-7105 is a medium severity (CVSS 4.7) SQL injection in code-projects E-Commerce Website 1.0, in the search argument of index_search.php. VulDB called it critical. No fix is referenced, so do not run this sample app in production. The record describes public disclosure of the issue.
What's affected
The record lists code-projects E-Commerce Website version 1.0. It says the flaw is in index_search.php through the search argument and that it can be reached remotely. The record also says the exploit has been disclosed publicly and may be used, which is a statement about disclosure, not about confirmed attacks. The record does not mark it as known exploited.
The record text describes the issue as classified critical by VulDB (VDB-249000), while its CVSS score is 4.7 medium. Both are stated here. No vendor fix is referenced in the record.
How to check if you're exposed
Find out whether the project is deployed anywhere. Search your hosting, code repositories and training environments for code-projects sample apps.
grep -rl "index_search.php" /var/www 2>/dev/null
These projects are often downloaded for learning and then left running on a public host. If you find one, take it offline.
What to do now
- Remove the application from any internet-facing host.
- If you need the app for learning, run it in an isolated local environment only.
- Never reuse the database credentials from sample apps anywhere else.
- If you build on the code, move queries to parameterized statements and review every input.
Why it matters
The description says manipulating the search argument leads to SQL injection. The record tags CWE-89. The code is a free sample project rather than a maintained product, so there is no patch process to wait for.
SQL injection happens when input is mixed into a query as text instead of being passed as a bound parameter. The database cannot tell the developer's query from the attacker's additions. Parameterized queries remove the whole class, and they are cheap to adopt. Search boxes are a classic place to find this flaw because they pass text straight into a query.
Desktop and agent software is easy to miss because it sits outside the usual server patch cycle. Build a list of where it runs, push the update through your software deployment tool, and confirm the installed version afterward rather than trusting the job status.
Weakness class in the record: CWE-89 (SQL Injection).
Quick check
Why do tutorial apps show up as CVEs?
They get downloaded and deployed as real sites. Researchers test them and file CVEs, which helps defenders find copies running in the wild.
How do I confirm the fix landed?
Check the version on a sample of hosts after rollout and keep the output as evidence. Deployment tools can report success while some hosts miss the update.
Sources
The VulDB page was not read, so details come from the NVD record.
Last reviewed: 19 October 2026.
