| Título | code-projects Pharmacy Management System 1.0 SQL Injection |
|---|
| Descripción | A **critical SQL injection vulnerability** has been identified in the **Pharmacy Management System** version 1.0, specifically during the **invoice creation process**. The issue lies in how the system retrieves the list of medicines based on a search query passed through the `text` parameter. The input is not properly sanitized, allowing attackers to inject and execute arbitrary SQL commands.
When creating a new invoice, the system queries the medicine database using the `text` parameter to display matching results. However, the lack of input validation makes it vulnerable to SQL injection attacks. Exploiting this flaw could allow unauthorized access to sensitive data, such as medicine inventory details, and even manipulation or deletion of records. This vulnerability is **critical**, as it compromises both the availability and integrity of the system. Immediate remediation is necessary to avoid disruption of pharmaceutical operations and data breaches. |
|---|
| Fuente | ⚠️ https://gist.github.com/higordiego/be616d2853a9f1820d8558fc00e97e24 |
|---|
| Usuario | c4ttr4ck (UID 75518) |
|---|
| Sumisión | 2024-10-19 17:59 (hace 2 años) |
|---|
| Moderación | 2024-10-20 20:49 (1 day later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 281021 [code-projects Pharmacy Management System 1.0 /add_new_invoice.php text inyección SQL] |
|---|
| Puntos | 20 |
|---|