CVE-2021-41649: Unauthenticated SQL injection in online-shopping-system-advanced cat_id parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with CVSS 9.8 and high EPSS makes exploitation likely and impact severe.

What it is

The PuneethReddyHC online-shopping-system-advanced application fails to sanitize the cat_id parameter in a POST request to /homeaction.php, allowing unauthenticated SQL injection. Because the endpoint is reachable without credentials and the flaw affects confidentiality, integrity and availability, it is a serious risk for any exposed deployment.

Impact

An attacker can read, modify or destroy database contents and potentially execute database-level operations, compromising the whole shopping application and its stored data.

Attack surface

Reached over the network via a POST request to /homeaction.php with a crafted cat_id parameter; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Public exploit references exist (GitHub and video advisories), and EPSS is high at roughly 0.52 (98.9th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the vendor fix or upgrade to a patched version of online-shopping-system-advanced if one is available.
• If no patch exists, replace or retire the affected component, or isolate it from untrusted networks.
• Use parameterized queries or prepared statements for all database access in homeaction.php and similar endpoints.
• Deploy a WAF rule to block SQL injection patterns on the cat_id parameter and other unsanitized inputs.
• Restrict database account privileges used by the application to the minimum required.

Detection

• Monitor web logs for POST requests to /homeaction.php with suspicious cat_id values containing SQL metacharacters or keywords.
• Alert on database errors or unusual query patterns originating from the web application.
• Baseline normal cat_id values and flag deviations, especially from single source IPs.
• Review database audit logs for unexpected reads, writes or schema changes from the application account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.