Executive brief
The Pharmacy Sales and Inventory System, a web application for managing pharmaceutical retail operations, contains a security flaw that allows unauthorized access to sensitive business data. An attacker can bypass login requirements to view private sales records, medicine pricing, and supplier payment information. This could lead to the exposure of financial summaries and competitive business intelligence without any technical expertise or user interaction.
Technical details
A broken access control vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0 within the 'sell_statement' and 'supplier_payment' functions of 'application/controllers/ShowForm.php'. The root cause is a logical error in the authentication check where an OR operator (||) is used instead of an AND operator (&&) when validating session data. This flaw causes the authorization condition to always evaluate to true, allowing unauthenticated remote attackers to bypass login requirements. Successful exploitation allows an attacker to access the 'sales_product' database table and view sensitive financial information, including invoice numbers, unit prices, and revenue totals.
Affected products
- SourceCodester Pharmacy Sales and Inventory System 1.0
Timeline
- 2026-05-09: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-06-01: advisory: CVE-2026-10255 published by VulDB/NVD.