code-projects Pharmacy Management System manage_invoice.php sql injection

Vulnerability

A critical SQL injection vulnerability exists in code-projects Pharmacy Management System version 1.0. The flaw resides in the file /manage_invoice.php, specifically in the invoice_number parameter used by the deletion functionality. The application fails to sanitize this input, allowing an attacker to inject arbitrary SQL commands via a GET request [2]. No authentication is required to reach the endpoint.

Exploitation

An attacker can exploit the vulnerability by sending a crafted GET request to /php/manage_invoice.php?action=delete&invoice_number=... with malicious SQL payloads appended to the invoice_number parameter. A public proof-of-concept demonstrates using time-based blind injection (e.g., BENCHMARK) to confirm the injection [2]. The attack requires no prior authentication and can be initiated remotely over HTTP.

Impact

Successful exploitation allows an attacker to manipulate the underlying database, potentially deleting invoice records, exposing sensitive data, or disrupting financial operations. The vulnerability is rated critical due to the ease of exploitation and the potential for data compromise [1][2].

Mitigation

As of the publication date (2024-10-19), no patch is available from the vendor. The manufacturer (code-projects) has not released a fix, and the software is considered unpatched [2]. Users should consider isolating the application from untrusted networks, applying input validation and parameterized queries, or discontinuing use until a security update is provided.