CVE-2025-11476 is a high severity SQL injection flaw (CVSS 7.3) in SourceCodester Simple E-Commerce Bookstore 1.0, reached through the login_username argument in /index.php. No fixed version is confirmed in the sources reviewed. Take the app off the public internet, replace the query with a prepared statement, and check the vendor for updates.
What's affected
- Product: SourceCodester Simple E-Commerce Bookstore
- Affected: version 1.0
- Weak point: the login_username argument handled by /index.php
- Fixed version: none confirmed. The researcher report linked below describes the flaw and does not point to a patched release, so treat every deployment of this version as exposed until the vendor says otherwise
The record describes the issue as remote, and the CVSS base score is 7.3 (HIGH). The CVSS vector says no account is needed, so anyone who can reach the page over the network is in scope.
The weakness is classified as CWE-89 (SQL injection) and its parent category CWE-74 (injection). Neither is specific to this product. They describe the same coding mistake, which is building a database query out of text the user controls.
How to check if you're exposed
This is downloadable PHP style source code rather than a package from a registry, so there is no single package manager command. Work through three checks instead.
First, find out whether you run it. Search your web roots and deployment inventory for the product name and for /index.php.
grep -rIl "login_username" /path/to/webroot --include="*.php" --include="*.java"
Second, open the file and look at how the login_username value reaches the database. If it is joined into a query string, the code is exposed. If it is passed as a bound parameter, it is not.
Third, look at your web server access logs for requests to /index.php that carry quote characters or SQL keywords in the parameter. A match does not prove a compromise, but it tells you someone is probing.
grep -iE "union|select|sleep|%27" /var/log/apache2/access.log | grep "index.php"
What to do now
- Decide whether you need this app at all. If it is a demo or a learning project, shut it down and remove it from the server.
- If you must keep it running, restrict access. Put it behind a VPN, an IP allow list or HTTP authentication so it is not reachable by the open internet.
- Fix the query in /index.php. Replace string concatenation with a prepared statement and bind login_username as a value. The pattern looks like this, with names changed to match your schema.
$stmt = $pdo->prepare("SELECT * FROM items WHERE id = :id");
$stmt->execute([':id' => $value]);
- Give the database account the app uses only the permissions it needs. An account that cannot drop tables or read other schemas limits the damage of any injection.
- Watch the vendor page and the researcher issue for a patched release, and review the advisory before you rely on one. No fixed version is confirmed here.
- Add the app to your dependency and code scanning so the next flaw in it does not wait for a headline.
Why it matters
SQL injection happens when an application builds a database query from text a visitor controls, so the database cannot tell the developer's instructions from the visitor's data. The /index.php page takes the login_username argument and, according to the CVE record, ends up with that value inside a query in an unsafe way.
The CVE record also says an exploit has been published. That does not mean attacks are under way. The record does not mark this as a CISA Known Exploited Vulnerability, and nothing in the sources says it is exploited in the wild. It does mean the barrier to trying it is low, because the write up is a search away.
The deeper lesson is that the fix is cheap and mechanical. Prepared statements close this whole class of bug for the query they cover, and a code scan can find the rest of the string built queries in the same project.
Quick check
Is there a patched version of Simple E-Commerce Bookstore?
No fixed version is confirmed in the record or the report we reviewed. Check the vendor site and the project issue before relying on any update, and fix the query yourself if the source is under your control.
Is CVE-2025-11476 being exploited in the wild?
The record says an exploit is publicly available, but it is not in the CISA Known Exploited Vulnerabilities catalog and no source we reviewed reports attacks. Act as if scanning is likely.
Sources
- Researcher issue and write up
- CVE record and CVSS vector for CVE-2025-11476, as published on 2025-10-08
Last reviewed: 19 October 2026.
