CVE-2026-4825

SourceCodester Sales and Inventory System HTTP GET Parameter update_sales.php sql injection

CVSS 5.3 MEDIUMEPSS 0.3%CWE-74 CWE-89

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

25 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file /update_sales.php of the component HTTP GET Parameter Handler. The manipulation of the argument sid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

SourceCodester · Sales and Inventory System

Referências

https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateSales-sid.md https://vuldb.com/?ctiid.353125 https://vuldb.com/?id.353125 https://vuldb.com/?submit.775175 https://www.sourcecodester.com/