Description
A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file sales_invoice1.php of the component GET Parameter Handler. This manipulation of the argument sellid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-03-09
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection via the sellid GET parameter
Action: Patch now
AI Analysis

Impact

The vulnerability exists in the SourceCodester Sales and Inventory System 1.0 and allows an attacker to manipulate the sellid GET parameter to inject arbitrary SQL statements. This leads to unauthorized data retrieval, modification, or deletion, exposing sensitive business information and compromising database integrity. The weakness is characterized by CWE-74 (Scripting via HTML Injection) and CWE-89 (SQL Injection).

Affected Systems

SourceCodester Sales and Inventory System version 1.0 is affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% reflects a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on an unauthenticated client providing a crafted GET request to the sales_invoice1.php endpoint, which then executes the injected SQL against the database.

Generated by OpenCVE AI on April 16, 2026 at 04:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to a patched version of SourceCodester Sales and Inventory System if the vendor publishes one.
  • If no patch is available, sanitize the sellid GET parameter so that it accepts only validated numeric values or drop the parameter altogether.
  • Restrict the database user associated with the application to the minimum permissions required, avoiding full read/write access to all tables.
  • Deploy a web application firewall rule that blocks known SQL injection patterns against the sales_invoice1.php endpoint.

Generated by OpenCVE AI on April 16, 2026 at 04:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester sales And Inventory System
Vendors & Products Sourcecodester
Sourcecodester sales And Inventory System

Mon, 09 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Ahsanriaz26gmailcom
Ahsanriaz26gmailcom sales And Inventory System
CPEs cpe:2.3:a:ahsanriaz26gmailcom:sales_and_inventory_system:1.0:*:*:*:*:*:*:*
Vendors & Products Ahsanriaz26gmailcom
Ahsanriaz26gmailcom sales And Inventory System

Mon, 09 Mar 2026 02:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file sales_invoice1.php of the component GET Parameter Handler. This manipulation of the argument sellid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Title SourceCodester Sales and Inventory System GET Parameter sales_invoice1.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Ahsanriaz26gmailcom Sales And Inventory System
Sourcecodester Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-10T20:15:56.755Z

Reserved: 2026-03-08T07:24:05.096Z

Link: CVE-2026-3793

cve-icon Vulnrichment

Updated: 2026-03-10T20:15:53.752Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-09T03:15:49.070

Modified: 2026-03-09T15:04:07.067

Link: CVE-2026-3793

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T04:15:24Z

Weaknesses