CVE-2026-37343

Root

Cause

The vulnerability exists in the /parking/manage_user.php endpoint of the SourceCodester Vehicle Parking Area Management System v1.0. The id parameter is directly concatenated into SQL queries without proper sanitization or parameterization, leading to SQL injection [1].

Exploitation

An attacker can exploit this by sending a crafted GET request to /parking/manage_user.php with a malicious id parameter. For example, the payload id=0%20union%20select%201,2,3,database(),5--+ allows retrieval of the database name (parking_db). The attack does not require prior authentication; the provided reference uses an admin session but demonstrates the injection works regardless of privileges [1].

Impact

Successful exploitation enables an attacker to read arbitrary data from the database, including potentially sensitive user information, credentials, or other application data. This could lead to privilege escalation or further compromise of the system.

Mitigation

No official patch has been released as of the publication date. The vendor, SourceCodester, has not addressed the vulnerability in the current v1.0 release [1]. Users should sanitize the id parameter using prepared statements or parameterized queries and apply input validation.