Executive brief
A vulnerability exists in the SourceCodester Multi-Vendor Online Grocery Management System, a web application used for managing grocery sales. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially exposing sensitive information such as user credentials, customer data, and order history. This could lead to a complete compromise of the system's data and a loss of customer trust.
Technical details
An error-based SQL injection vulnerability exists in the save_shop_type() function within classes/Master.php. The application uses PHP's extract($_POST) to assign variables and then directly concatenates the 'id' parameter into a SQL query without sanitization. Furthermore, the application's capture_err() helper returns raw MySQL error strings in JSON responses. An attacker can use MySQL's extractvalue() function to trigger XPath syntax errors that contain the results of arbitrary SQL queries, allowing for full data extraction. This vulnerability requires low-level authentication (e.g., administrator access) and can be exploited remotely. No patch is currently available; remediation should involve using prepared statements and disabling verbose database error reporting in production.
Affected products
- SourceCodester Multi-Vendor Online Grocery Management System 1.0, 5.7.26
Timeline
- 2026-06-03: disclosed: Vulnerability details and PoC published on GitHub.
- 2026-07-05: advisory: CVE published in NVD.