Description

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-14T13:17:38.150Z",
  "pubdate": "2026-08-14T13:17:38.150Z",
  "executiveSummary": "A security vulnerability has been identified within SourceCodester Simple Client Management System 1.0, specifically residing in the service saving mechanism. This flaw manifests as a SQL Injection vulnerability affecting the backend database interaction layer. The vulnerability stems from improper neutralization of user-supplied input passed via the ID parameter to the vulnerable endpoint. Remote attackers can leverage this weakness to manipulate database queries, leading to unauthorized data access, potential modification or deletion of database contents, and compromise of the underlying database integrity. The risk is elevated due to the public disclosure of exploit materials, allowing threat actors with network access to execute attacks without prior authentication or high-level privileges, depending on the application's configuration. Immediate remediation is required to prevent systemic compromise of the host environment.",
  "technicalDetails": "The vulnerability is classified as a SQL Injection (SQLi) flaw, located in the file /classes/Master.php within the save_service function of SourceCodester Simple Client Management System 1.0. The root cause of this vulnerability lies in the insecure handling of HTTP request parameters within database query constructions. Specifically, the argument ID is accepted via the input vector and concatenated or directly embedded into dynamic SQL statements executed by the underlying database management system without adequate sanitization, parameterization, or input validation.\nThe attack flow proceeds as follows: an unauthenticated or authenticated remote attacker crafts an HTTP request targeting the endpoint /classes/Master.php?f=save_service. Within this request, the attacker injects malicious SQL payload syntax into the vulnerable ID parameter. Because the application fails to utilize prepared statements or parameterized queries, the database interpreter parses the attacker-supplied input as executable SQL commands rather than inert literal data.\nNetwork exposure for this vulnerability is remote, meaning the attack can be executed across a network without requiring physical access to the server hosting the application. Privilege requirements and authentication dependencies depend on the access controls enforced by the front-end routing, but the endpoint design exposes the database logic directly to manipulation through the request parameter. Post-exploitation impact includes the potential extraction of sensitive database records, bypassing of authentication mechanisms, execution of arbitrary administrative database operations, and in severe configurations, remote code execution or complete takeover of the underlying host operating system via database interaction features."
}