CVE-2023-7107 is a SQL injection in the sign-up page of code-projects E-Commerce Website 1.0. It scores 7.3 (High) and needs no login. The record names no fixed version, so the safe choices are to take the app offline or rewrite its queries to use prepared statements before exposing it again.
What's affected
The record lists E-Commerce Website 1.0 from code-projects. The affected file is user_signup.php, and the description names the arguments firstname, middlename, email, address, contact and username as ways in.
No fixed version appears in the record. The description does not say the exploit is public for this entry, though a sibling CVE for the same product (CVE-2023-7106) does. The KEV flag is false, and I found no advisory saying it is exploited in the wild.
Severity note: the description calls it critical (a VulDB label, VDB-249002), while the NVD vector gives 7.3, which is High. The title follows the score. The vector is network reachable, low complexity, no privileges and no user interaction, with low impact on each of confidentiality, integrity and availability.
How to check if you're exposed
Because the sign-up form is public, anyone who can reach the site can reach the flaw. Check your own copy.
find . -name user_signup.php
grep -nE "INSERT|mysqli_query|\$_POST" user_signup.php
Look for query strings built by joining form values. If you find that pattern, the page is exposed. Also check the web server access log for sign-up requests with unusual punctuation in the name or email fields, which can indicate probing.
What to do now
- Treat E-Commerce Website 1.0 as unpatched. The record names no fixed version and I could not confirm one from a vendor page, so do not assume a newer download is safe without checking.
- Take the sign-up page offline or block it at the web server until the queries are rewritten.
- Rewrite the INSERT and any lookup in user_signup.php to use prepared statements, and validate the email and contact fields on the server.
- Review the user table for accounts you do not recognise, and rotate the database password if the app has been public.
- Give the database account only the rights it needs, and keep this app away from other databases.
Why it matters
SQL injection is the classic result of building a database query by joining strings, so that a value the user supplied can change the meaning of the query instead of being treated as plain data. The weakness class is CWE-89. The durable fix is not a filter for bad characters. It is parameterized queries, where the query text and the values travel separately and the database never confuses one for the other.
Beyond the code fix, the account the application uses to talk to the database matters. An app that connects with broad rights turns a small bug into a large one. A narrowly scoped database user limits what a successful injection can read or change.
Sign-up pages are a common weak point because they accept many free-text fields and run before any login. Six separate parameters here means six places the same mistake can hide, which is why fixing one line is rarely enough.
Quick check
Does the attacker need an account for CVE-2023-7107?
No. The vector shows no privileges required, and the affected page is the public sign-up form.
Why does the description say critical but the score says High?
The word critical is a VulDB label in the description. The CVSS 3.1 score in NVD is 7.3, which falls in the High band.
Sources
Last reviewed: 19 October 2026.
