Description

A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=delete_supplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-16T02:16:48.633Z",
  "pubdate": "2026-08-16T02:16:48.633Z",
  "executiveSummary": "A vulnerability has been identified in SourceCodester Stock Management System 1.0, specifically within the processing logic of the /classes/Master.php?f=delete_supplier endpoint. The vulnerability is classified as a SQL Injection (SQLi) flaw, arising from the improper handling of user-supplied input passed via the 'id' parameter. This security defect allows remote attackers to manipulate database queries directly, bypassing intended application logic. Successful exploitation of this vulnerability can lead to unauthorized access, extraction, modification, or deletion of sensitive database contents, potentially compromising the entire underlying database management system. The attack can be executed remotely over the network without requiring prior authentication, depending on the application exposure, and the public availability of exploit code significantly elevates the associated risk. Organizations utilizing this software are exposed to critical data integrity and confidentiality risks until appropriate remediation steps are applied.",
  "technicalDetails": "The vulnerability resides in the backend processing script located at /classes/Master.php when handling the delete_supplier function. The root cause of the SQL Injection vulnerability stems from a failure in input sanitization and parameterized query implementation. Specifically, the argument 'id', which identifies the supplier record to be deleted, is directly concatenated into or evaluated within a Structured Query Language (SQL) statement executed against the database without adequate escaping or type casting.\nThe attack flow begins when an unauthenticated or remotely positioned adversary crafts a malicious Hypertext Transfer Protocol (HTTP) request targeting the vulnerable endpoint /classes/Master.php?f=delete_supplier. By injecting specially crafted SQL payloads into the 'id' parameter, the attacker can alter the syntactic structure of the original database query. Because the application dynamically executes the unsanitized input, the database engine interprets the malicious input as executable database commands rather than literal parameter data.\nThe vulnerable component is the database interaction layer within the Master.php script. The affected version is Stock Management System 1.0. The vulnerability is exposed over the network, allowing remote attackers to launch exploitation attempts. Depending on the database user permissions configured for the web application, successful execution of the SQL injection payload can permit the extraction of sensitive tables (such as administrator credentials and user data) via techniques like UNION-based queries, error-based extraction, or blind inference. Furthermore, depending on database configurations and underlying privileges, attackers could potentially escalate privileges, execute operating system commands, or cause a denial of service by corrupting or dropping critical database tables."
}