CVE-2026-4568
SourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Mar 23, 2026
- Updated
- May 6, 2026
- Reserved
- Mar 22, 2026
Description
A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /update_supplier.php of the component HTTP GET Request Handler. The manipulation of the argument sid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Sales and Inventory SystemSourceCodester |
|
References
- VDB-352405 | SourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injectionvdb-entrytechnical-description
- VDB-352405 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #775161 | SourceCodester Sales and Inventory System 1.0 SQL Injectionthird-party-advisory
- https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateSupplier-sid.md?plain=1exploitpatch
- https://www.sourcecodester.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.