Summary

SourceCodester Inventory Management System 1.0 contains a SQL injection vulnerability in sell_return.php. The pid request parameter is used in a SQL statement without sanitization or parameterization, letting a remote, unauthenticated attacker inject arbitrary SQL.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 Critical.

Details

sell_return.php incorporates the pid parameter directly into a query without binding it or validating its type. An attacker can break out of the intended statement and append arbitrary SQL. As with the other endpoints in this release, no authentication is required and the page is network-reachable.

Impact

Read/write access to the application database, disclosure of inventory, sales, and user records, data tampering, and potential escalation toward command execution depending on database privileges.

Remediation

  • Use parameterized queries / prepared statements for every query referencing pid.
  • Validate pid as an integer before use.
  • Run the application’s database account with least privilege.

This affects the end-of-life 1.0 release; no vendor patch is available.

Disclosure Timeline

  • 2023-08-06 — Publicly disclosed (VDB-236219 / CVE-2023-4184).

References