CVE-2026-0592 is a SQL injection flaw in Online Product Reservation System 1.0 from code-projects, in /handgunner-administrator/register_code.php. NVD scores it 7.3, high severity, and the record says an exploit has been published. No fixed version is listed, so the fix is to correct the query in your copy or take the app offline.
What's affected
- Product: Online Product Reservation System, version 1.0, from code-projects.
- Component: /handgunner-administrator/register_code.php, parameter fname, lname, address, city, province, country, zip, tel_no, email and username.
- Fixed version: none listed in the CVE record or the public report. Check the vendor page for any newer release.
- Severity: CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The vector lists no privileges required. - Exploitation: the record says exploit details are public. It is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
This is source code you host, not a library, so start by finding out whether you run it at all.
# Look for the vulnerable file in your web roots
find /var/www -type f -path "*register_code.php" 2>/dev/null
# See who has been requesting it
grep -h "register_code.php" /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null | wc -l
If the file exists and the site is reachable from the internet, treat it as exposed. The free dependency scan at gold.safeguard.sh/scan reads manifests, so it will not flag a flaw inside a PHP script like this one. Use it for the libraries around the app.
What to do now
- Take the app off the public internet, or put it behind a VPN or an authenticating reverse proxy, until the query is fixed.
- Check code-projects for a newer release of the project and read its notes. The CVE record does not name one.
- If you keep running it, change the code in register_code.php so fname, lname, address, city, province, country, zip, tel_no, email and username reaches the database through a prepared statement (PDO or mysqli) instead of string concatenation.
- Run the database account for this app with only the privileges it needs. It should not own the schema or be able to read other databases.
- Search access logs for unusual requests to register_code.php and for database errors in the PHP log, then reset any passwords that may have been exposed.
Why it matters
The weakness is CWE-89 (improper neutralization of special elements in an SQL command), a child of CWE-74 (injection). The app builds a query by pasting request data straight into SQL text, so the database cannot tell data from instructions. The public report for this product family describes that exact pattern.
The registration handler takes ten profile fields, and the record says all of them can be manipulated. A signup form writes personal data (names, addresses, phone numbers, email) into the database, so a flaw here is a privacy problem as well as a code problem. If you ran this app with real customers, think about whether notification rules apply to you.
Quick check
Is there a patch for CVE-2026-0592?
None is listed in the CVE record. Check code-projects for a newer release, and if there is none, fix the query yourself or stop running the app.
Why does registration data raise the stakes?
The table holds names, addresses, phone numbers and email addresses. If that data was exposed, privacy law in your region may require action, so involve whoever owns that decision.
Sources
Last reviewed: 19 October 2026.
