CVE-2025-11511 is a medium severity SQL injection flaw (CVSS 6.3) in code-projects E-Commerce Website 1.0, reached through the supp_email argument in /pages/supplier_add.php. No fixed version is confirmed in the sources reviewed. Take the app off the public internet, replace the query with a prepared statement, and check the vendor for updates.
What's affected
- Product: code-projects E-Commerce Website
- Affected: version 1.0
- Weak point: the supp_email argument handled by /pages/supplier_add.php
- Fixed version: none confirmed. The researcher report linked below describes the flaw and does not point to a patched release, so treat every deployment of this version as exposed until the vendor says otherwise
The record describes the issue as remote, and the CVSS base score is 6.3 (MEDIUM). The CVSS vector lists a low privilege account as the starting point, so the risk is highest where self registration or shared logins exist.
The weakness is classified as CWE-89 (SQL injection) and its parent category CWE-74 (injection). Neither is specific to this product. They describe the same coding mistake, which is building a database query out of text the user controls.
How to check if you're exposed
This is downloadable PHP style source code rather than a package from a registry, so there is no single package manager command. Work through three checks instead.
First, find out whether you run it. Search your web roots and deployment inventory for the product name and for /pages/supplier_add.php.
grep -rIl "supp_email" /path/to/webroot --include="*.php" --include="*.java"
Second, open the file and look at how the supp_email value reaches the database. If it is joined into a query string, the code is exposed. If it is passed as a bound parameter, it is not.
Third, look at your web server access logs for requests to /pages/supplier_add.php that carry quote characters or SQL keywords in the parameter. A match does not prove a compromise, but it tells you someone is probing.
grep -iE "union|select|sleep|%27" /var/log/apache2/access.log | grep "supplier_add.php"
What to do now
- Decide whether you need this app at all. If it is a demo or a learning project, shut it down and remove it from the server.
- If you must keep it running, restrict access. Put it behind a VPN, an IP allow list or HTTP authentication so it is not reachable by the open internet.
- Fix the query in /pages/supplier_add.php. Replace string concatenation with a prepared statement and bind supp_email as a value. The pattern looks like this, with names changed to match your schema.
$stmt = $pdo->prepare("SELECT * FROM items WHERE id = :id");
$stmt->execute([':id' => $value]);
- Give the database account the app uses only the permissions it needs. An account that cannot drop tables or read other schemas limits the damage of any injection.
- Watch the vendor page and the researcher issue for a patched release, and review the advisory before you rely on one. No fixed version is confirmed here.
- Add the app to your dependency and code scanning so the next flaw in it does not wait for a headline.
Why it matters
SQL injection happens when an application builds a database query from text a visitor controls, so the database cannot tell the developer's instructions from the visitor's data. The /pages/supplier_add.php page takes the supp_email argument and, according to the CVE record, ends up with that value inside a query in an unsafe way.
The CVE record also says an exploit has been published. That does not mean attacks are under way. The record does not mark this as a CISA Known Exploited Vulnerability, and nothing in the sources says it is exploited in the wild. It does mean the barrier to trying it is low, because the write up is a search away.
If the same author wrote the rest of the app, expect similar patterns elsewhere in it. Fixing one file and leaving the others is the usual way these projects collect several CVEs in a row.
Quick check
Is there a patched version of E-Commerce Website?
No fixed version is confirmed in the record or the report we reviewed. Check the vendor site and the project issue before relying on any update, and fix the query yourself if the source is under your control.
Is CVE-2025-11511 being exploited in the wild?
The record says an exploit is publicly available, but it is not in the CISA Known Exploited Vulnerabilities catalog and no source we reviewed reports attacks. Act as if scanning is likely.
Sources
- Researcher issue and write up
- CVE record and CVSS vector for CVE-2025-11511, as published on 2025-10-08
Last reviewed: 19 October 2026.
