CVE-2026-4779

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in SourceCodester Sales and Inventory System 1.0. This issue affects some unknown processing of the file update_customer_details.php of the component HTTP GET Parameter Handler. Such manipulation of the argument sid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Sales and Inventory System	1.0

References

https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateCustomerDetails-sid.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.352797Permissions Required, VDB Entry
https://vuldb.com/?id.352797Third Party Advisory, VDB Entry
https://vuldb.com/?submit.775172Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: Mar 24, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-477906.3A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can th CVE-2026-47808.8A vulnerability was detected in SourceCodester Sales and Inventory System 1.0. Impacted is an unknown function of the file update_out_standi CVE-2026-47818.8A flaw has been found in SourceCodester Sales and Inventory System 1.0. The affected element is an unknown function of the file update_purch CVE-2026-47826.5The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get CVE-2026-478258.6Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. Th CVE-2026-478269.1The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive inf CVE-2026-478277.5Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell commands via command inje CVE-2026-478288.8During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore o CVE-2026-478297.8Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process w CVE-2026-47836.3A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin CVE-2026-478308.5Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users CVE-2026-478317.7Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows a rem