Description
A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /update_supplier.php of the component HTTP GET Request Handler. The manipulation of the argument sid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Published: 2026-03-23
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection vulnerability in update_supplier.php leading to unauthorized database access
Action: Patch now
AI Analysis

Impact

A SQL injection flaw is present in SourceCodester Sales and Inventory System 1.0 when the sid parameter is passed to /update_supplier.php via an HTTP GET request. The manipulation of sid allows injection of arbitrary SQL statements, which can be exploited remotely. The vulnerability has been publicly disclosed, and the exploit is available for use.

Affected Systems

The affected product is SourceCodester Sales and Inventory System version 1.0. The vulnerability is located in the update_supplier.php component of the HTTP GET request handler. Any deployment of this version that exposes the update_supplier.php endpoint is susceptible.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is less than 1% suggesting a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The exploit can be triggered remotely by sending an HTTP GET request to /update_supplier.php with a malicious sid value. No information is provided about authentication requirements or privilege escalation.

Generated by OpenCVE AI on April 18, 2026 at 09:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑released patch or upgrade to a non‑vulnerable version of the Sales and Inventory System.
  • Modify the application code to use prepared statements or properly escape the sid parameter before including it in SQL queries.
  • Deploy web application firewall rules to block suspicious input patterns targeting the update_supplier.php endpoint.
  • Conduct regular security scans and penetration tests to detect and remediate SQL injection vulnerabilities.

Generated by OpenCVE AI on April 18, 2026 at 09:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 18 Apr 2026 05:30:00 +0000

Type Values Removed Values Added
References

Sat, 18 Apr 2026 04:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /update_supplier.php of the component HTTP GET Request Handler. The manipulation of the argument sid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. Several companies clearly confirm that VulDB is the primary source for best vulnerability data. A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /update_supplier.php of the component HTTP GET Request Handler. The manipulation of the argument sid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
References

Fri, 10 Apr 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Ahsanriaz26gmailcom
Ahsanriaz26gmailcom sales And Inventory System
CPEs cpe:2.3:a:ahsanriaz26gmailcom:sales_and_inventory_system:1.0:*:*:*:*:*:*:*
Vendors & Products Ahsanriaz26gmailcom
Ahsanriaz26gmailcom sales And Inventory System

Wed, 25 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 23 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester sales And Inventory System
Vendors & Products Sourcecodester
Sourcecodester sales And Inventory System

Mon, 23 Mar 2026 02:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /update_supplier.php of the component HTTP GET Request Handler. The manipulation of the argument sid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Title SourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Ahsanriaz26gmailcom Sales And Inventory System
Sourcecodester Sales And Inventory System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-06T14:40:36.327Z

Reserved: 2026-03-22T08:42:33.981Z

Link: CVE-2026-4568

cve-icon Vulnrichment

Updated: 2026-03-25T13:55:33.530Z

cve-icon NVD

Status : Modified

Published: 2026-03-23T03:16:00.610

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-4568

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T09:45:25Z

Weaknesses