Executive brief
Sourcecodester Cab Management System, a web application for managing taxi or cab services, contains a security flaw in its administrative interface. An attacker with administrative credentials can exploit this to view sensitive database information that they might not otherwise have access to. While this requires an existing high-level account, it could lead to further data exposure or assist in more complex attacks against the system's underlying data.
Technical details
A SQL injection vulnerability exists in Sourcecodester Cab Management System v1.0 within the '/cms/admin/categories/view_category.php' file. The 'id' GET parameter is improperly neutralized before being used in a database query, allowing for UNION-based SQL injection. An attacker with high-privileged (admin) session cookies can provide a crafted payload to leak sensitive information, such as the database name or other schema details. The vulnerability was identified in an environment running PHP 8.1 via XAMPP. No official patch is currently documented.
Affected products
- Sourcecodester Cab Management System 1.0
Timeline
- 2026-04-13: disclosed: Initial disclosure and CVE assignment
- 2026-04-13: advisory: NVD publication date