Executive brief
The Computer and Mobile Repair Shop Management System, a web application for managing repair business operations, contains a security flaw in its administrative inquiry viewer. An attacker with administrative access can exploit this to run unauthorized database queries, potentially leading to the exposure of sensitive business data. This could compromise the confidentiality of customer records and internal system information.
Technical details
A SQL injection vulnerability exists in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 within the '/rsms/admin/inquiries/view_details.php' component. The 'id' GET parameter is not properly sanitized before being used in a database query, allowing for UNION-based SQL injection. An attacker with high privileges (administrative access) can exploit this vulnerability over the network to extract sensitive information from the database, such as the database name or other table data. The vulnerability was identified in an environment running PHP 8.1 via XAMPP.
Affected products
- Sourcecodester Computer and Mobile Repair Shop Management System 1.0
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory