Description
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_product. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-08-06
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw lies in the delete_product handler within the Master.php module; by altering the ID argument, an attacker can inject arbitrary SQL that may read, modify, or delete database contents without further privileges. Because the injection can be performed remotely from the web interface, an adversary could compromise confidentiality, integrity, and availability of the shop’s data.

Affected Systems

SourceCodester Computer Repair Shop Management System version 1.0 is impacted. The vulnerable endpoint is /classes/Master.php?f=delete_product. No other affected versions or products are enumerated in the available data.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. The exploit has been publicly disclosed and can be launched over the network without authentication, raising the risk level. EPSS data is unavailable, and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers could exploit the web interface using manipulated ID values to perform unauthorized database operations.

Generated by OpenCVE AI on August 6, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Computer Repair Shop Management System to the latest patched release that corrects the SQL injection in the delete_product functionality.
  • If an update is not possible, immediately restrict the delete_product endpoint so that only authenticated, privileged users can access it, or block the endpoint from unauthenticated traffic altogether.
  • Revise the delete_product code to use parameterized queries and enforce strict numeric validation on the ID input to eliminate injection vectors.

Generated by OpenCVE AI on August 6, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_product. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Title SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection
First Time appeared Sourcecodester
Sourcecodester computer Repair Shop Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:computer_repair_shop_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester computer Repair Shop Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Computer Repair Shop Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-06T12:28:15.659Z

Reserved: 2026-08-05T21:35:40.127Z

Link: CVE-2026-19021

cve-icon Vulnrichment

Updated: 2026-08-06T12:28:09.242Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T10:00:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')