CVE-2026-10255 in Pharmacy Sales and Inventory System
Summary
by MITRE • 06/01/2026
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function sell_statement of the file application/controllers/ShowForm.php. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/01/2026
This vulnerability resides within the SourceCodester Pharmacy Sales and Inventory System version 1.0, specifically targeting the sell_statement function located in application/controllers/ShowForm.php. The flaw represents a critical access control weakness that allows unauthorized users to bypass legitimate authentication mechanisms and execute privileged operations. The vulnerability manifests through improper input validation and insufficient authorization checks within the controller layer, enabling malicious actors to manipulate the application's normal flow and gain access to restricted functionalities. Security researchers have identified this issue as a significant concern for systems handling sensitive pharmaceutical inventory data and sales transactions.
The technical exploitation of this vulnerability occurs through remote attack vectors that leverage the lack of proper access control validation within the sell_statement function. Attackers can craft malicious requests that bypass authentication checks and manipulate the system's behavior to perform unauthorized sales operations, view confidential inventory data, or access restricted administrative functions. This type of vulnerability falls under the CWE-285 access control weakness category, specifically addressing improper access control mechanisms. The remote nature of the exploit means that attackers do not require physical access to the system or local network privileges to carry out successful attacks, making the vulnerability particularly dangerous for web-based applications.
The operational impact of this vulnerability extends beyond simple unauthorized access, potentially compromising the integrity and confidentiality of pharmaceutical inventory records, sales data, and customer information. Attackers could manipulate sales transactions, alter inventory levels, or gain access to sensitive patient data, creating risks for both business operations and regulatory compliance. This vulnerability directly impacts the application's security posture and could lead to financial losses, data breaches, and potential violations of healthcare data protection regulations such as HIPAA. The disclosure of the exploit to the public means that threat actors can readily implement this attack without requiring specialized knowledge or tools.
Organizations utilizing this pharmacy management system should immediately implement mitigations including input validation controls, proper authentication enforcement, and access control checks within the affected controller function. The recommended approach involves implementing comprehensive authorization mechanisms that verify user privileges before executing sensitive operations, adding proper parameter validation to prevent malicious input manipulation, and ensuring that all controller functions enforce appropriate access control policies. Security measures should also include network segmentation, web application firewalls, and regular security assessments to identify similar vulnerabilities. The ATT&CK framework categorizes this vulnerability under privilege escalation and credential access techniques, emphasizing the need for layered defensive measures including proper access control implementation and regular security testing to prevent exploitation of such weaknesses.