code-projects Pharmacy Management System index.php sql injection

Vulnerability

A SQL injection vulnerability exists in the file /index.php?action=editPharmacist of code-projects Pharmacy Management System version 1.0. The id parameter is not properly sanitized, allowing an attacker to inject arbitrary SQL commands. The affected version is 1.0.

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted HTTP request to the vulnerable endpoint with a malicious id parameter. No authentication is required. The exploit has been publicly disclosed, making it straightforward to replicate.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL queries against the database. This can lead to unauthorized access, data exfiltration, modification, or deletion of sensitive information. The impact is critical due to the potential for full database compromise.

Mitigation

As of the publication date (2024-08-25), no official patch has been released by the vendor. Users should consider disabling the vulnerable functionality or implementing input validation and parameterized queries as a workaround. The vendor (code-projects) has not provided a fix.