SourceCodester Medicine Tracker System GET Parameter view_details.php sql injection
Description
A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracker System 1.0. This issue affects some unknown processing of the file medicines/view_details.php of the component GET Parameter Handler. The manipulation of the argument GET leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223283.
Affected products
1- Range: 1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing input sanitization in the GET parameter 'id' allows SQL injection."
Attack vector
An attacker sends a crafted HTTP GET request to `/php-mts/app/medicines/view_details.php` with a malicious `id` parameter. The parameter value is not sanitized before being used in a SQL query, allowing the attacker to inject arbitrary SQL statements. Two proof-of-concept payloads are demonstrated: a UNION-based injection that extracts data via `concat(0x51525354,0x41424344,0x61626364)` and a time-based blind injection using `sleep(15)` to confirm the vulnerability through response delay [ref_id=1]. The attack is remotely exploitable over HTTP with no authentication required.
Affected code
The vulnerability exists in the file `/php-mts/app/medicines/view_details.php` [ref_id=1]. The GET parameter `id` is processed without sanitization before being used in a SQL query, allowing injection of arbitrary SQL statements.
What the fix does
No patch is provided in the bundle. The advisory does not include a fix. To remediate this vulnerability, the application should use prepared statements or parameterized queries for the `id` parameter in `view_details.php` instead of directly concatenating user input into SQL queries. Input validation and proper escaping of the `id` parameter would also prevent injection.
Preconditions
- networkAttacker must be able to send HTTP requests to the web server hosting the Medicine Tracker System.
- inputThe application must accept the 'id' GET parameter without sanitization.
Reproduction
1. Send a GET request to `/php-mts/app/medicines/view_details.php?id=-1' union all select null,null,null,concat(0x51525354,0x41424344,0x61626364),null,null-- -` [ref_id=1]. 2. Observe that the response includes the concatenated string `QRSTABCDabcd` in the output, confirming UNION-based SQL injection. 3. Alternatively, send `id=1' and (select 2 from (select(sleep(15)))a) AND 'c'='c` and verify the server takes approximately 15 seconds to respond, confirming time-based blind SQL injection [ref_id=1].
Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- github.com/GodGua/bug_report/blob/main/SQLi-1.mdmitreexploit
- vuldb.commitresignaturepermissions-required
- vuldb.commitrevdb-entrytechnical-description
News mentions
0No linked articles in our index yet.