EUVD-2026-58656
GHSA-f3vr-438m-jqqm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint with trivial SQL injection yielding limited data read/write; no availability impact identified from description.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in SourceCodester Simple Client Management System 1.0 exposes the application's database to unauthenticated remote attackers via the unsanitized ID parameter in /classes/Master.php?f=save_service. The vulnerability allows arbitrary SQL query manipulation, enabling data exfiltration and potential data modification against the backend database. A publicly disclosed proof-of-concept exploit exists (referenced in GitHub issue lyf3273/CVE/issues/3), elevating near-term exploitation risk for any internet-exposed instances despite the limited prevalence of this product.
Technical ContextAI
The affected application is a PHP-based web management system distributed by SourceCodester, a repository of small open-source PHP/MySQL educational projects. The vulnerable endpoint /classes/Master.php?f=save_service accepts an ID argument that is passed directly into a SQL query without adequate sanitization or use of parameterized statements. CWE-74 (Injection) is the assigned root cause class, encompassing the more specific CWE-89 (SQL Injection) pattern. The attack surface is an HTTP-reachable PHP script, consistent with the CVSS 4.0 attack vector of AV:N/AC:L/AT:N, meaning no special network position or attack precondition is required. The CVSS 4.0 vector carries an E:P (Exploit Proof-of-Concept) modifier, confirming the existence of working public exploit code.
RemediationAI
No vendor-released patch has been identified at time of analysis. The vulnerability was reported via VulDB (submission 869618) and publicly disclosed through a GitHub issue (https://github.com/lyf3273/CVE/issues/3), but no corresponding upstream fix or patched release is referenced in the available data. As an immediate compensating control, restrict network access to the /classes/Master.php endpoint via firewall rules or web server ACLs if the endpoint is not required to be publicly accessible - this eliminates remote exploitation at the cost of breaking the save_service functionality for remote clients. Deploy a Web Application Firewall rule to detect and block SQL injection payloads targeting this endpoint. For developers, the root fix requires replacing any dynamic SQL string construction in save_service with PDO or MySQLi prepared statements and bound parameters, and validating that ID is an integer before use. Monitor VulDB entry https://vuldb.com/vuln/389958 for patch updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today