Description
A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Published: 2026-08-17
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a classic SQL injection that occurs in /admin/get_barcode_data.php when the barcode parameter is not properly sanitized. An attacker can inject arbitrary SQL statements, potentially exfiltrating sensitive data, modifying database records, or escalating privileges. The flaw allows remote exploitation, as the vulnerable code is reachable over HTTP without additional authentication constraints.

Affected Systems

This flaw affects SourceCodester's Pet Grooming Management Software version 1.0, specifically the get_barcode_data.php endpoint located under the /admin directory. No other versions or modules were explicitly mentioned as impacted.

Risk and Exploitability

The CVSS v3.1 base score is 6.9, reflecting a moderate severity that includes network attack vector, user interaction, and scope. EPSS data is not currently available, and the vulnerability is not listed in the active KEV list, but publicly published exploits are known. It is likely that remote attackers could use the injection to alter database contents or gain data. Given the exposure, the risk is notable for administrators with internet-facing deployments.

Generated by OpenCVE AI on August 17, 2026 at 21:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of SourceCodester Pet Grooming Management Software that includes a patch for the get_barcode_data.php input handling.
  • If an upgrade is not immediately possible, replace the raw barcode query with a parameterized statement or temporarily block the endpoint until remediation can be performed.
  • Apply input validation on the barcode parameter to ensure only expected formats reach the database layer.
  • Deploy a Web Application Firewall configured to detect and block SQL injection patterns targeting the barcode input.

Generated by OpenCVE AI on August 17, 2026 at 21:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Title SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection
First Time appeared Sourcecodester
Sourcecodester pet Grooming Management Software
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:pet_grooming_management_software:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester pet Grooming Management Software
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Pet Grooming Management Software
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-17T19:53:30.061Z

Reserved: 2026-08-17T13:05:00.085Z

Link: CVE-2026-75014

cve-icon Vulnrichment

Updated: 2026-08-17T19:53:25.475Z

cve-icon NVD

Status : Received

Published: 2026-08-17T20:16:47.647

Modified: 2026-08-17T20:16:47.647

Link: CVE-2026-75014

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T21:45:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')