Description

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_type. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-14T03:16:20.880Z",
  "pubdate": "2026-08-14T03:16:20.880Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in SourceCodester Air Cargo Management System 1.0, specifically within an unknown function handling the parameter ID in the file /classes/Master.php?f=save_cargo_type.\nThis vulnerability allows remote attackers to manipulate input parameters, leading to unauthorized execution of database queries.\nThe flaw exposes the underlying database architecture to potential data exfiltration, modification, or destruction, severely compromising the confidentiality, integrity, and availability of the affected system.\nThe attack can be executed remotely over the network without requiring complex prerequisites beyond access to the vulnerable endpoint.\nPublic disclosure of the exploit increases the risk of active exploitation by malicious actors seeking to compromise vulnerable deployments of the Air Cargo Management System.",
  "technicalDetails": "The vulnerability stems from improper neutralization of user-supplied input within the SQL query construction process inside the application backend.\nSpecifically, the attack vector targets the ID argument processed by the endpoint located at /classes/Master.php?f=save_cargo_type.\nWhen a remote attacker supplies crafted input containing SQL meta-characters or statements via the ID parameter, the application fails to properly sanitize or parameterize the input before incorporating it into database queries executed against the backend database management system.\nThe attack flow begins with the adversary sending a maliciously crafted HTTP request targeting the vulnerable /classes/Master.php script with the action parameter set to save_cargo_type and the ID parameter manipulated to inject arbitrary SQL syntax.\nBecause the application dynamically constructs database queries using unvalidated input, the injected SQL commands are interpreted and executed directly by the database engine.\nThis allows the attacker to alter the intended logic of the database query, potentially bypassing authentication mechanisms, extracting sensitive application data, or executing administrative database operations depending on the privileges associated with the database connection.\nThe vulnerable component is identified as the server-side PHP script /classes/Master.php managing cargo type persistence logic within SourceCodester Air Cargo Management System version 1.0.\nExploitation requires network connectivity to the target application endpoint, and the attack can be executed remotely by unauthenticated or authenticated users depending on access controls enforced by the script.\nPost-exploitation impact includes full database compromise, unauthorized read and write access to stored records, and potential escalation of privileges within the hosting environment."
}