Executive brief
A vulnerability exists in the SourceCodester Simple POS and Inventory System, a web application used for managing retail sales and stock. An attacker can exploit this flaw to bypass security controls and access the underlying database without needing a username or password. This could lead to the theft of sensitive business data, including administrator credentials and customer transaction records.
Technical details
A SQL injection vulnerability exists in SourceCodester Simple POS and Inventory System 1.0 within the '/user/search.php' and '/user/search_result.php' endpoints. The 'Name' POST parameter in 'search.php' and the 'id' GET parameter in 'search_result.php' are directly interpolated into SQL queries without sufficient sanitization or the use of prepared statements. A remote, unauthenticated attacker can provide crafted SQL payloads (such as UNION-based queries) to bypass authentication or extract sensitive data, including MD5 password hashes from the 'user' table. Additionally, the application is reportedly susceptible to reflected Cross-Site Scripting (XSS) as database-sourced values are rendered in the UI without proper output encoding.
Affected products
- SourceCodester Simple POS and Inventory System 1.0
Timeline
- 2026-04-26: disclosed: Initial discovery and PoC published on GitHub Gist
- 2026-05-25: advisory: CVE published and VulDB entry created