CVE-2026-3792 - Vulnerability Analysis

Overview

SourceCodester Sales and Inventory System 1.0 contains a sql injection caused by manipulation of the "purchaseid" GET parameter in purchase_invoice.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

Severity & Score

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data theft or modification.

Mitigation

Update to the latest version or apply vendor patches addressing this vulnerability.

References

• https://vuldb.com/?ctiid.349759
• https://vuldb.com/?id.349759
• https://vuldb.com/?submit.768047
• https://www.sourcecodester.com/
• https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-PurchaseInvoice-purchaseid.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner