SourceCodester Sales and Inventory System SQL Injection Vulnerability in Update Purchase PHP

A SQL injection vulnerability has been identified in SourceCodester Sales and Inventory System version 1.0. The issue arises in the 'update_purchase.php' file, where the 'sid' parameter in the HTTP GET request is not properly sanitized. This flaw allows authenticated attackers to inject arbitrary SQL commands, exploiting the application’s MySQL database. The vulnerability supports UNION-based injections, enabling direct retrieval of sensitive database information, as well as Boolean-based and Time-based blind injection techniques.

Impact

Successful exploitation allows attackers to inject SQL commands that can be executed by the application's database, potentially leading to unauthorized data access, data manipulation, or other malicious database operations.

Reproduction

To reproduce this vulnerability, log into the application and send a crafted HTTP GET request to 'update_purchase.php' with a SQL injection payload in the 'sid' parameter. Alternatively, use SQLMap to automate the exploitation.