Indian Invoicing System EUVD-2026-31614

Exploitation requires a valid authenticated session with at least low-privilege access (PR:L per CVSS 4.0 vector), ruling out unauthenticated remote exploitation. The target system must be running SourceCodester Indian Invoicing System 1.0 with the Invoice Generation Handler at /Invoicing/IGST_Invoice.php accessible over the network. No additional special configuration is required beyond having the application deployed and accessible (AC:L, AT:N). Limiting factors include: mandatory authentication before exploitation, the low deployment prevalence of this niche PHP application, and the fact that SSVC classifies the attack as not automatable, meaning mass scanning and exploitation is not feasible without per-target credential acquisition.

Despite the publicly available proof-of-concept exploit, multiple signals converge on low real-world risk. The CVSS 4.0 score is 2.1 (Low), reflecting limited scope: VC:L/VI:L/VA:L with no subsequent system impact (SC:N/SI:N/SA:N). PR:L confirms that exploitation requires prior authentication with at least low-privilege credentials, ruling out unauthenticated mass exploitation. EPSS at 0.03% (8th percentile) indicates the broader security community assigns very low probability of exploitation in the next 30 days. SSVC assessment corroborates this: exploitation is at POC stage, the attack is not automatable, and technical impact is only partial. KEV status is absent, confirming no confirmed active exploitation by CISA. The primary real-world risk is insider threat or credential-compromised scenarios in small businesses running this specific niche application. The low deployment footprint of a SourceCodester community project further constrains blast radius.

An attacker who has obtained valid low-privilege credentials to the Indian Invoicing System - through credential stuffing, phishing, or default credential reuse - navigates to /Invoicing/IGST_Invoice.php and submits a crafted invoice generation request with SQL payloads embedded in the customer_name or category fields. The unsanitized input is passed directly to the backend MySQL query, allowing the attacker to enumerate database contents such as customer records, invoice data, or application credentials. A proof-of-concept demonstrating this technique is publicly available at https://gist.github.com/c4ttr4ck/f60dfb9fc65a98ad6dde1840dc2c1a5e.