PT-2026-27524 · Sourcecodester · Sales/Inventory System

Fukun · Published 2026-03-24 · Updated 2026-03-25 · CVE-2026-4781

NVD

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

A flaw has been found in SourceCodester Sales and Inventory System 1.0. The affected element is an unknown function of the file update purchase.php of the component HTTP GET Parameter Handler. Executing a manipulation of the argument sid can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-4781

Affected Products

Sales/Inventory System

References · 6

• 🔥 https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdatePurchase-sid.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4781 · Security Note
• https://sourcecodester.com · Note
• https://vuldb.com/?ctiid.352799 · Note
• https://vuldb.com/?id.352799 · Note
• https://vuldb.com/?submit.775174 · Note