Description
A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This impacts the function update_settings_info of the file classes/SystemSettings.php of the component Setting Handler. Such manipulation of the argument content[] leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-07-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the update_settings_info function of SystemSettings.php in SourceCodester Multi‑Vendor Online Grocery Management System version 1.0. By manipulating the content[] parameter, an attacker can inject arbitrary code that the application will execute, leading to unauthorized code execution on the server. This flaw is classified as CWE‑74 and CWE‑94 and can potentially allow manipulation of application data or full compromise of the hosting environment.

Affected Systems

SourceCodester Multi‑Vendor Online Grocery Management System version 1.0 is affected. No other product versions are mentioned. The flaw resides in the Setting Handler component, specifically classes/SystemSettings.php.

Risk and Exploitability

The CVSS score of 5.3 describes moderate severity, and the EPSS score of <1% indicates a low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; an attacker only needs to send a crafted request to the update_settings_info endpoint to trigger code injection, as the content[] parameter is externally reachable.

Generated by OpenCVE AI on August 1, 2026 at 19:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor's patch that sanitizes the content[] parameter in update_settings_info.
  • If no patch is available, enforce authentication on the update_settings_info endpoint and remove any code-generation logic from the content[] handling.
  • Deploy a web application firewall and configure it to block requests containing suspicious code patterns in content[].
  • If the endpoint is unnecessary for business operations, disable it entirely or restrict its accessibility to trusted IP ranges.

Generated by OpenCVE AI on August 1, 2026 at 19:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This impacts the function update_settings_info of the file classes/SystemSettings.php of the component Setting Handler. Such manipulation of the argument content[] leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Title SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injection
First Time appeared Sourcecodester
Sourcecodester multi-vendor Online Grocery Management System
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:sourcecodester:multi-vendor_online_grocery_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester multi-vendor Online Grocery Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Multi-vendor Online Grocery Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:21:35.636Z

Reserved: 2026-07-04T04:58:54.895Z

Link: CVE-2026-14691

cve-icon Vulnrichment

Updated: 2026-07-06T16:21:31.619Z

cve-icon NVD

Status : Deferred

Published: 2026-07-05T02:17:40.907

Modified: 2026-07-06T18:02:49.450

Link: CVE-2026-14691

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T19:45:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')