CVE-2026-2865 is a high severity (CVSS 7.3) SQL injection in itsourcecode Agri-Trading Online Shopping System 1.0. The Product argument in the admin product controller reaches a database query. A public exploit is noted and the record lists no fix, so take the application offline or isolate it.
What's affected
The record names Agri-Trading Online Shopping System 1.0 from itsourcecode, in the file admin/productcontroller.php (the HTTP POST request handler), through the Product parameter.
No patched version is listed. Treat all copies as affected.
How to check if you're exposed
Search your servers for the project file named in the record:
find /var/www -name productcontroller.php -path '*admin*' 2>/dev/null
A match inside this project means you run the affected code. The VulDB entry lists the report details.
What to do now
- List every place this application runs, including development copies.
- Remove it from public access, or limit the admin area to a trusted network.
- If it must run, change the query to use parameterized statements and give the database account minimal rights.
- Back up the database and review it for signs of tampering.
- Re-check the vendor site and VulDB for a fixed release.
Why it matters
This is SQL injection, CWE-89, in the wider injection class CWE-74. A value from a POST request ends up inside query text, so the database cannot tell data from commands.
Student-style and template shopping systems often carry this flaw repeatedly, and the records tell us the exploit is public. According to the record the CVE is not in CISA's Known Exploited Vulnerabilities list. If the app handles real customers, treat it as a retirement candidate.
Quick check
Do I need to be logged in as admin?
The CVSS vector in the record lists no privileges required, so do not rely on the admin path name for protection. Restrict access at the network layer.
Sources
Last reviewed: 19 October 2026.
