Summary

SourceCodester Inventory Management System 1.0 contains a SQL injection vulnerability in edit_sell.php. The up_pid request parameter is placed into a SQL statement without sanitization or parameterization, letting a remote, unauthenticated attacker inject arbitrary SQL.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 Critical.

Details

edit_sell.php reads up_pid and concatenates it directly into a query. Because the value is neither type checked nor bound as a parameter, an attacker can terminate the intended expression and append their own clauses. The endpoint requires no authentication and is reachable over the network, so exploitation is trivial.

Impact

Read/write access to the application database, disclosure of inventory, sales, and user records, tampering with stored data, and, depending on database privileges, escalation toward command execution.

Remediation

  • Use parameterized queries / prepared statements for every query referencing up_pid.
  • Validate up_pid as an integer before use.
  • Run the application’s database account with least privilege.

This affects the end-of-life 1.0 release; no vendor patch is available.

Disclosure Timeline

  • 2023-08-06 — Publicly disclosed (VDB-236217 / CVE-2023-4182).

References