Executive brief
The SourceCodester Indian Invoicing System, a web application for managing business invoices, contains a security vulnerability that allows attackers to access or modify sensitive database information. By submitting specially crafted text into customer or category fields, an attacker can trick the system into revealing private data like user credentials or administrative records. This could lead to a full compromise of the invoicing data and unauthorized access to the underlying server's database.
Technical details
A second-order SQL injection vulnerability exists in /Invoicing/IGST_Invoice.php within the Invoice Generation Handler component. While the primary ID parameter is validated, the application retrieves previously stored data from the 'orders', 'customers', and 'category' tables and uses these values (specifically customer_name and category_id) to construct new SQL queries without sanitization or prepared statements. An attacker with low-level privileges can first store a malicious SQL payload via forms like add_customer.php; when an invoice is later generated, the payload is executed in the context of the secondary query. This allows for unauthorized data exfiltration, including user credentials from the 'users' table. As of the advisory date, the vulnerability remains unpatched.
Affected products
- SourceCodester Indian Invoicing System 1.0
Timeline
- 2026-04-26: other: Vulnerability discovered and PoC created by researcher
- 2026-05-25: disclosed: Vulnerability published and CVE assigned