CVE-2025-15409 is a high severity SQL injection (CVSS 7.3) in code-projects Online Guitar Store 1.0. The del_pro parameter in /admin/Delete_product.php reaches a database query unsafely, and the record says an exploit is public. No fixed version is confirmed, so take the app offline or put it behind authentication.
What's affected
The record lists code-projects Online Guitar Store 1.0 as affected. The weak spot is /admin/Delete_product.php, the admin page that removes a product. The input is the del_pro parameter. NVD describes the function only as unknown, so the exact line is not given.
The same product has three sibling reports from the same disclosure: CVE-2025-15407, CVE-2025-15408, CVE-2025-15410. Each covers a different file, and fixing one does not fix the rest.
The record says the exploit has been disclosed publicly. It gives no fixed version and no vendor patch, and the code-projects site is a source of free sample applications rather than a maintained product. If you run it, assume it will not be patched for you.
How to check if you're exposed
This is a small PHP sample application, so the question is mostly whether it is running anywhere at all.
- Search web roots and old project folders for the file name:
find / -name "Delete_product.php" 2>/dev/null
- Check web server access logs for requests to
/admin/Delete_product.phpthat carry quote characters or SQL keywords in thedel_provalue. Repeated requests with odd values from one address are the pattern to look for. - Look at database logs for syntax errors raised by that page.
If you only used this app for learning, check that it is not reachable from the internet.
What to do now
- Find every copy of Online Guitar Store you run and take internet facing copies offline.
- If you must keep it, require authentication at the web server in front of
/admin/Delete_product.phpand block the path for everyone else. - Review database accounts used by the app and remove rights it does not need, such as access to other schemas.
- If you maintain a fork, change the query behind
del_proto a parameterized statement and apply the same fix to the sibling files. - Rotate database credentials and review the data store if the app was exposed after the public disclosure.
Why it matters
The record carries CWE-89, SQL Injection, and CWE-74, Injection in general. The pattern is a request value that is pasted into a query string. The database cannot tell the developer's SQL from the visitor's text, so crafted input changes what the query does.
The CVSS vector is network based with no privileges (7.3), with low impact on confidentiality, integrity and availability. It is not listed in CISA's Known Exploited Vulnerabilities catalog in the record. Sample shops like this one often keep real customer data in tests or demos, which is the quiet risk.
Quick check
Is there a patch for CVE-2025-15409?
None is confirmed. The record gives no fixed version and the vendor did not respond according to the disclosure. Remove or restrict the app.
What is the safest code change?
Use parameterized queries (prepared statements) for every value that comes from a request, and keep database permissions narrow.
Sources
Last reviewed: 19 October 2026.
