Authentication bypass via unsanitized password query

SQL injection in Code Projects Online Shopping System 1.0 allows remote attackers to bypass login authentication through login.php. The handler escapes the submitted email but concatenates the unfiltered password value directly into a SELECT query, allowing injected SQL to alter query logic or trigger a time delay. No authentication or user interaction is required; the published proof of concept shows account impersonation and extraction of plaintext user passwords and administrator password hashes.