SourceCodester Simple POS and Inventory System GET Parameter deleteproduct.php delete sql injection

Vulnerability

The SourceCodester Simple POS and Inventory System 1.0 is vulnerable to SQL injection via the id GET parameter in multiple admin endpoints [1]. The files /admin/deleteproduct.php, /admin/deletecustomer.php, and /admin/deletesupplier.php retrieve the id value directly from $_GET['id'] and concatenate it into SQL queries without sanitization, type casting, or the use of prepared statements [1]. For example, deleteproduct.php executes: $pid = $_GET['id']; $a = mysqli_query($conn, "select * from product where productid='$pid'"); [1]. The vulnerability can be triggered by any authenticated user with access to these admin pages [1].

Exploitation

An attacker must be authenticated to the application [1]. The attack can be launched remotely by crafting a GET request to any of the vulnerable endpoints with a malicious payload in the id parameter [1]. The public proof-of-concept demonstrates a time-based blind SQL injection using a SLEEP(5) command: GET /admin/deleteproduct.php?id=1' AND SLEEP(5)-- - [1]. A 5-second delay confirms successful injection [1]. Error-based and UNION-based injection techniques are also possible [1].

Impact

Successful exploitation allows an attacker to delete arbitrary records from the product, customer, and supplier tables, compromising data integrity [1]. Via UNION-based injection, the attacker can extract sensitive data including usernames and MD5 password hashes, impacting confidentiality [1]. Mass deletion could cause complete business disruption, affecting availability [1]. The reference also notes potential for Remote Code Execution via INTO OUTFILE if the database user has root privileges [1].

Mitigation

The vendor has not released a patched version as of publication [1]. The vulnerability is currently unpatched [1]. No workarounds are provided in the available references [1]. The application is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. Administrators should restrict access to admin pages, use a web application firewall (WAF) to filter malicious inputs, or replace the application with a supported alternative [1].