Executive brief
The SourceCodester Multi-Vendor Online Grocery Management System contains a security flaw in its order cancellation feature. This vulnerability allows a registered user to perform unauthorized database operations by sending specially crafted requests. An attacker could exploit this to extract sensitive information, including user credentials and personal data, potentially leading to a full compromise of the system's database.
Technical details
A time-based blind SQL injection vulnerability exists in SourceCodester Multi-Vendor Online Grocery Management System 1.0. The root cause is the use of PHP's extract($_POST) function in the cancel_order() function within classes/Master.php, which assigns the 'id' parameter to a local variable that is then concatenated directly into a SQL UPDATE statement without sanitization or parameterization. An authenticated attacker can exploit this by sending a POST request with a malicious 'id' parameter containing SQL commands like SLEEP(). This allows for the extraction of database contents, including administrative credentials, through time-based inference. While the vendor has not released an official patch, the vulnerability can be mitigated by using prepared statements or casting the 'id' parameter to an integer.
Affected products
- SourceCodester Multi-Vendor Online Grocery Management System 1.0
Timeline
- 2026-06-03: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-07-05: advisory: NVD publication date