Executive brief
SourceCodester Inventory and Monitoring System is a PHP-based application used to track inventory and monitor assets. A SQL injection vulnerability in the assessment databank module allows remote attackers to inject malicious SQL commands via the difficulty_id parameter, potentially leading to unauthorized database access, data theft, or system compromise without requiring authentication.
Technical details
A SQL injection vulnerability exists in /admins/assessments/databank/btn_functions.php (action=add) where the difficulty_id parameter is directly concatenated into SQL queries without proper input validation or parameterized prepared statements. The vulnerability is unauthenticated and remotely exploitable via HTTP POST requests. An attacker can inject error-based SQL payloads (such as GTID_SUBSET) to extract database contents, modify data, or achieve arbitrary code execution depending on database permissions. No login is required to exploit this vulnerability. A public proof-of-concept has been released and the vulnerability is confirmed with sqlmap testing.
Affected products
- SourceCodester Inventory and Monitoring System 1.0
Timeline
- 2026-08-20: disclosed
- 2026-09-16: advisory