Executive brief
A vulnerability exists in the registration system of the SourceCodester Multi-Vendor Online Grocery Management System. This flaw allows an attacker to manipulate the underlying database during the account creation process. In practice, an attacker could create accounts with unauthorized privileges, bypass security restrictions, or block other users, potentially compromising the integrity of the grocery platform's user data.
Technical details
A SQL injection vulnerability exists in the save_client and save_vendor functions within classes/Users.php. The application iterates through all POST parameter keys and values to dynamically build an INSERT statement. While the values are escaped using real_escape_string(), the keys (column names) are not validated or sanitized. By including a backtick character in a POST field name, an attacker can break out of the column name quoting and inject additional 'column=value' pairs into the SQL command. This allows unauthenticated attackers to manipulate database columns that are not intended to be user-controllable, such as account status or delete flags.
Affected products
- SourceCodester Multi-Vendor Online Grocery Management System 1.0
Timeline
- 2026-06-03: disclosed: Vulnerability details shared on GitHub by researcher lee945
- 2026-07-05: advisory: NVD/VulDB advisory published