Is CVE-2026-9411 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9411 being exploited in the wild.

How severe is CVE-2026-9411?

Medium severity, with a CVSS score of 6.3, published 25 May 2026.

Which products and versions are affected?

SourceCodester Indian Invoicing System 1.0.

Is there a fix for CVE-2026-9411?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9411 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9411?

Check whether you run SourceCodester Indian Invoicing System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9411: SourceCodester Indian Invoicing System SQL injection in IGST_Invoice.php

CVE-2026-9411 · Severity: medium · CVSS 6.3 · Published 2026-05-25

The SourceCodester Indian Invoicing System, a web application for managing business invoices, contains a security vulnerability that allows attackers to access or modify sensitive database information. By submitting specially crafted text into customer or category fields, an attacker can trick the system into revealing private data like user credentials or administrative records. This could lead to a full compromise of the invoicing data and unauthorized access to the underlying server's database.

Technologies: SourceCodester Indian Invoicing System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-9411 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9411 being exploited in the wild.
How severe is CVE-2026-9411?: Medium severity, with a CVSS score of 6.3, published 25 May 2026.
Which products and versions are affected?: SourceCodester Indian Invoicing System 1.0.
Is there a fix for CVE-2026-9411?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9411 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9411?: Check whether you run SourceCodester Indian Invoicing System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A second-order SQL injection vulnerability exists in /Invoicing/IGST_Invoice.php within the Invoice Generation Handler component. While the primary ID parameter is validated, the application retrieves previously stored data from the 'orders', 'customers', and 'category' tables and uses these values (specifically customer_name and category_id) to construct new SQL queries without sanitization or prepared statements. An attacker with low-level privileges can first store a malicious SQL payload via forms like add_customer.php; when an invoice is later generated, the payload is executed in the context of the secondary query. This allows for unauthorized data exfiltration, including user credentials from the 'users' table. As of the advisory date, the vulnerability remains unpatched.

Affected products

SourceCodester Indian Invoicing System 1.0

Timeline

2026-04-26: other: Vulnerability discovered and PoC created by researcher
2026-05-25: disclosed: Vulnerability published and CVE assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.