CVE-2026-7447

SourceCodester Pet Grooming Management Software update_customer.php sql injection

View on CVE.org
Published Apr 30, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/update_customer.php. This manipulation of the argument type/length/business parameter validity causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Analysis

AI-generated

Technical impact

A flaw in the SourceCodester Pet Grooming Management Software allows attackers to inject arbitrary SQL through the /admin/update_customer.php endpoint by manipulating argument type and length parameters. This vulnerability is a classic SQL injection, tied to CWE-74 and CWE-89, enabling attackers to read, modify, or delete data in the underlying database, potentially compromising confidentiality, integrity, and availability of customer information.

Affected Systems

The affected product is SourceCodester Pet Grooming Management Software version 1.0. No additional affected versions are listed. The flaw resides in the administrative update_customer.php script.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS information is unavailable, so the likelihood of exploitation is unknown but the vulnerability is publicly disclosed and the exploit is published. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can exploit this remotely, as stated in the description, by sending crafted requests to the vulnerable endpoint.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch for SourceCodester Pet Grooming Management Software.
  • If a patch is not yet available, restrict remote access to the /admin/update_customer.php endpoint to trusted IP addresses.
  • Implement input validation or use parameterized queries in the update_customer.php script to prevent SQL injection.

Generated by OpenCVE AI on April 30, 2026 at 03:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester pet Grooming Management Software
Vendors & Products Sourcecodester
Sourcecodester pet Grooming Management Software
Type Values Removed Values Added
Description A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/update_customer.php. This manipulation of the argument type/length/business parameter validity causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Title SourceCodester Pet Grooming Management Software update_customer.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 5, 2026, 4:02 PM
Reserved
Apr 29, 2026, 4:59 PM

View source JSON

Updated
Apr 30, 2026, 12:10 PM

JSON

Status
Deferred
Published
Apr 30, 2026, 1:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 30, 2026, 3:45 AM

JSON