CVE-2023-4182
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0, affecting an unknown part of the file edit_sell.php. Manipulation of the argument up_pid leads to SQL injection.
Risk Assessment
An attacker can remotely exploit this vulnerability, posing a serious threat to the integrity of the organization's database.
Recommendation
It is recommended to immediately update the system to the latest version to eliminate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in SourceCodester Inventory Management System 1.0
See all- CVE-2026-13570Low
A cross-site scripting vulnerability was found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php. Manipulating the full_name argument in the user registration endpoint allows remote script execution. The exploit is publicly available.
- CVE-2026-13568High
A vulnerability has been found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php of the User Registration Endpoint. Manipulation of the role argument leads to improper access controls, allowing remote exploitation.
- CVE-2023-4749Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, allowing for remote attacks.
- CVE-2023-4558Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[0][data] in the staff_data.php file leads to SQL injection, which can be executed remotely.
- CVE-2023-4557Medium
A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_purchase_paymen_report.php leads to SQL injection.
- CVE-2023-4555Low
A vulnerability has been identified in SourceCodester Inventory Management System version 1.0 that allows cross site scripting (XSS) attacks through manipulation of the name/company argument in the suppliar_data.php file. The attack can be launched remotely.
- CVE-2023-4438Medium
A critical vulnerability has been identified in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the app/ajax/search_sales_report.php file leads to SQL injection, allowing for remote attacks.
- CVE-2023-4437Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. Manipulation of the 'customer' argument in the file app/ajax/search_sell_paymen_report.php leads to SQL injection, allowing for remote attacks.
- CVE-2023-4436Medium
A critical vulnerability has been found in SourceCodester Inventory Management System 1.0, affecting some unknown processing of the file app/action/edit_update.php. Manipulation of the argument user_id leads to SQL injection.
- CVE-2023-4201Medium
A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. The issue affects some unknown processing of the file ex_catagory_data.php, leading to SQL injection.
Original NVD description (English source)
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file edit_sell.php. The manipulation of the argument up_pid leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-236217 was assigned to this vulnerability.