{"id":"CVE-2026-4570","state":"PUBLISHED","title":"SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection","description":"A vulnerability was identified in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /view_customers.php of the component HTTP POST Request Handler. Such manipulation of the argument searchtxt leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.","publishedAt":"2026-03-23T03:41:37.847Z","updatedAt":"2026-03-23T16:39:03.196Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Sales and Inventory System"],"affected":[{"vendor":"SourceCodester","product":"Sales and Inventory System","versions":[{"version":"1.0","status":"affected"}],"modules":["HTTP POST Request Handler"]}],"references":["https://vuldb.com/?id.352407","https://vuldb.com/?ctiid.352407","https://vuldb.com/?submit.775165","https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-ViewCustomers-searchtxt.md","https://www.sourcecodester.com/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4570.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4570","state":"PUBLISHED","datePublished":"2026-03-23T03:41:37.847Z","dateUpdated":"2026-03-23T16:39:03.196Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-03-22T08:42:41.306Z"},"containers":{"cna":{"title":"SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection","descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /view_customers.php of the component HTTP POST Request Handler. Such manipulation of the argument searchtxt leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used."}],"affected":[{"vendor":"SourceCodester","product":"Sales and Inventory System","versions":[{"version":"1.0","status":"affected"}],"modules":["HTTP POST Request Handler"]}],"references":[{"url":"https://vuldb.com/?id.352407","name":"VDB-352407 | SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.352407","name":"VDB-352407 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.775165","name":"Submit #775165 | SourceCodester Sales and Inventory System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-ViewCustomers-searchtxt.md","tags":["exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-03-23T03:41:37.847Z"},"timeline":[{"time":"2026-03-22T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-03-22T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-03-22T09:47:56.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"FuKun (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-23T16:21:35.043203Z","id":"CVE-2026-4570","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-23T16:39:03.196Z"}}]}}}