code-projects Pharmacy Management System manage_supplier.php sql injection

Vulnerability

A critical SQL injection vulnerability exists in code-projects Pharmacy Management System version 1.0. The flaw resides in the /php/manage_supplier.php?action=search endpoint. The text parameter is not properly sanitized, allowing an attacker to inject arbitrary SQL commands via GET request. The vulnerability affects version 1.0 of the software, and no patch has been released as of the advisory date.[1][2]

Exploitation

An attacker can exploit this vulnerability remotely without authentication. By sending a crafted GET request to the vulnerable endpoint with a malicious payload in the text parameter, the attacker can execute arbitrary SQL statements. A proof-of-concept demonstrates using a time-based blind SQL injection technique (e.g., SLEEP(5)) to extract data. The exploit does not require special privileges beyond network access to the application.[2]

Impact

Successful exploitation allows an attacker to read, modify, or delete data in the underlying database. This could expose sensitive supplier information, operational or financial data, and potentially lead to full compromise of the database. The vulnerability is classified as critical due to the ease of exploitation and the sensitivity of the exposed data.[2]

Mitigation

No official patch or fix has been released by the vendor as of the publication date. Users are advised to apply input validation and use prepared statements or parameterized queries to mitigate the risk until a fix is available. The vulnerable software may be end-of-life or unmaintained, so migrating to a supported alternative is recommended.[1][2]