Executive brief
SourceCodester Simple POS and Inventory System is a web-based application used by small businesses to manage sales and stock. A security vulnerability in the administrative interface allows an attacker to interfere with the database by sending specially crafted web requests. This could lead to the unauthorized deletion of products, customers, or supplier records, as well as the potential theft of sensitive business data and user credentials.
Technical details
A SQL injection vulnerability exists in SourceCodester Simple POS and Inventory System 1.0 within the 'id' GET parameter handler used by several administrative scripts, including /admin/deleteproduct.php, /admin/deletecustomer.php, and /admin/deletesupplier.php. The application fails to sanitize the 'id' parameter before concatenating it into SQL queries using mysqli_query(). An authenticated attacker with administrative access can exploit this to perform error-based or UNION-based SQL injection. This allows for the deletion of arbitrary database records, exfiltration of sensitive information such as MD5 password hashes, or potentially remote code execution via 'INTO OUTFILE' if the database user has sufficient privileges. No patch is currently available; users are advised to implement prepared statements and cast input parameters to integers.
Affected products
- SourceCodester Simple POS and Inventory System 1.0
Timeline
- 2026-04-26: disclosed: Initial discovery and PoC published on GitHub Gist
- 2026-05-25: advisory: CVE published and VulDB entry created