Description
A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-08-14
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A security vulnerability has been identified in SourceCodester Simple Client Management System 1.0. The flaw exists in an unknown function of the file /classes/Master.php?f=save_service, where an attacker can manipulate the ID argument to inject arbitrary SQL statements. The injected payload is executed by the application’s database engine, giving the attacker the ability to read, modify or delete data. The weakness is a classic SQL injection in the context of an input that is not properly sanitized, which aligns with CWE‑74 and CWE‑89.

Affected Systems

All installations of SourceCodester Simple Client Management System 1.0 that use the /classes/Master.php script are vulnerable. The specific file affected is /classes/Master.php?f=save_service within the system’s core code.

Risk and Exploitability

The CVSS score of 6.9 categorises the vulnerability as moderate, and the EPSS score is not available, implying no current data on exploitation probability. The vulnerability can be exploited remotely and has been publicly disclosed, but it is not listed in the CISA KEV catalog. Attackers with network access to the application can supply a crafted ID parameter to execute arbitrary SQL against the database.

Generated by OpenCVE AI on August 14, 2026 at 14:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SourceCodester Simple Client Management System to the latest patch or apply the vendor‑supplied fix that sanitises the ID argument in Master.php.
  • Modify the Master.php code to use prepared statements and validate the ID as an integer before incorporating it into any SQL query.
  • Restrict access to the save_service functionality through authentication checks or firewall rules so that only authorised administrators can invoke it.

Generated by OpenCVE AI on August 14, 2026 at 14:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Title SourceCodester Simple Client Management System Master.php save_service sql injection
First Time appeared Sourcecodester
Sourcecodester simple Client Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_client_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple Client Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Simple Client Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-14T13:58:20.014Z

Reserved: 2026-08-14T05:38:31.978Z

Link: CVE-2026-19825

cve-icon Vulnrichment

Updated: 2026-08-14T13:58:16.655Z

cve-icon NVD

Status : Received

Published: 2026-08-14T13:17:38.150

Modified: 2026-08-14T14:16:50.597

Link: CVE-2026-19825

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T15:45:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')