Executive brief
SourceCodester Simple POS and Inventory System is a web-based application used for managing retail sales and stock. A security vulnerability in the customer and supplier management modules allows an attacker with administrative access to manipulate database queries. This can lead to unauthorized modification of other user accounts, including the primary administrator, potentially resulting in a full takeover of the system and its data.
Technical details
A chained vulnerability exists in SourceCodester Simple POS and Inventory System 1.0 within /admin/edit_customer.php and /admin/edit_supplier.php. The application fails to sanitize the 'id' GET parameter and various POST parameters before concatenating them into SQL UPDATE statements, leading to SQL injection. Additionally, the application lacks proper authorization checks (IDOR), allowing an authenticated user to modify any record by changing the 'id' parameter. An attacker can exploit this to overwrite the administrator's credentials or extract sensitive data from the database. The vulnerability is currently unpatched, and public exploits are available.
Affected products
- SourceCodester Simple POS and Inventory System 1.0
Timeline
- 2026-04-26: disclosed: Initial discovery and PoC published on GitHub gist
- 2026-05-25: advisory: NVD publication date