CVE-2026-4569
SQL Injection in SourceCodester Sales Inventory /view_category.php
Publication date: 2026-03-23
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ahsanriaz26gmailcom | sales_and_inventory_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'The CVE-2026-4569 vulnerability is a SQL Injection flaw in the SourceCodester Sales and Inventory System version 1.0, specifically in the file view_category.php within the HTTP POST Request Handler component.'}, {'type': 'paragraph', 'content': "The vulnerability arises because the application does not properly sanitize the 'searchtxt' parameter in HTTP POST requests used in the category list search functionality."}, {'type': 'paragraph', 'content': 'This allows an authenticated attacker to inject arbitrary SQL commands into the backend MySQL database.'}, {'type': 'paragraph', 'content': 'The injection supports UNION-based queries as well as Boolean-based and Time-based blind SQL injection techniques, enabling attackers to retrieve and display sensitive data directly on the webpage.'}] [1]
How can this vulnerability impact me? :
This vulnerability allows attackers to exfiltrate sensitive data by retrieving entire database contents, including categories and other tables.
Attackers can enumerate the database to discover tables, columns, and schema details.
Such unauthorized data access can lead to data breaches, loss of confidentiality, and potential manipulation of database contents.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the vulnerable parameter `searchtxt` in HTTP POST requests to the file `/view_category.php` for SQL injection flaws.'}, {'type': 'paragraph', 'content': 'You can use tools like sqlmap to automate detection by sending crafted payloads to the target URL.'}, {'type': 'paragraph', 'content': 'Example sqlmap command to test the vulnerability:'}, {'type': 'list_item', 'content': 'sqlmap -u "http://127.0.0.1:8089/view_category.php" --data "searchtxt=test&Search=Search" --batch -v 6 --risk=3 --cookie "PHPSESSID=YOUR_COOKIE_HERE"'}, {'type': 'paragraph', 'content': 'This command tests the `searchtxt` POST parameter for UNION-based, Boolean-based, and Time-based blind SQL injection techniques.'}, {'type': 'paragraph', 'content': 'Alternatively, manual testing can be done by submitting payloads such as:'}, {'type': 'list_item', 'content': "UNION Query Payload: searchtxt=test%' UNION ALL SELECT CONCAT(0x717a706b71,0x465864524e435543554d7a7752444e47494378686f63635149775668734c676f70416773416e4768,0x716a766b71),NULL,NULL#&Search=Search"}, {'type': 'list_item', 'content': "Boolean-based Blind Payload: searchtxt=test%' AND 3898=3898#&Search=Search"}, {'type': 'list_item', 'content': "Time-based Blind Payload: searchtxt=test%' AND (SELECT 9457 FROM (SELECT(SLEEP(5)))bddE) AND 'gein%'='gein&Search=Search"}] [1]
What immediate steps should I take to mitigate this vulnerability?
I don't know