Executive brief
CodeAstro Ingredients Stock Management System is a web-based application used to track and manage food inventory. A security vulnerability in this system allows an attacker to perform unauthorized database operations. This could lead to the theft of sensitive inventory data, modification of stock records, or disruption of the management system's availability.
Technical details
A SQL injection vulnerability exists in CodeAstro Ingredients Stock Management System 1.0 within the '/Ingredients-Stock/add_stock.php' file. The root cause is the improper neutralization of the 'id' GET parameter before its use in a SQL query. A remote attacker with low privileges can exploit this by sending specially crafted SQL commands (such as time-based blind payloads) to the server. Successful exploitation allows for unauthorized database access, data leakage, and potential tampering with the underlying database records. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Ingredients Stock Management System 1.0
Timeline
- 2026-05-21: disclosed: Initial disclosure on GitHub issues
- 2026-06-08: advisory: CVE published and NVD record created