Executive brief
A grocery store management system contains a security flaw that allows unauthorized individuals to manipulate database queries. By sending specially crafted requests to the product search feature, an attacker can bypass security controls to view sensitive business data, customer information, or administrative credentials. This could lead to a total breach of the store's digital records and unauthorized access to management functions.
Technical details
A SQL injection vulnerability exists in the 'scost' POST parameter of '/grocery/search_products.php' in the Grocery Store Management System v1.0. The application fails to sanitize user input before incorporating it into a backend SQL query. An unauthenticated remote attacker can exploit this using Boolean-based or error-based injection techniques to execute arbitrary SQL commands. Successful exploitation allows the attacker to enumerate the database, extract sensitive information such as user credentials, and potentially bypass authentication. The vulnerability is confirmed to allow execution of functions like 'database()' to reveal schema information.
Affected products
- anirudhkannanvp GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN 1.0
Timeline
- 2026-06-25: disclosed: Initial vulnerability report and CVE assignment
- 2026-06-25: advisory: NVD publication date