EUVD-2026-91647
GHSA-gwj2-xvrf-m6g8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSend crafted ID parameter to delete.php
-
ExecutionInject SQL into backend query
-
ImpactExtract or manipulate database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session (CVSS PR:L) to the Simple Pharmacy Management System and the ability to reach the /SimplePharmacy-PHP/product/delete.php endpoint, which is reached by supplying a crafted value in the ID parameter - the specific injectable argument named in the advisory. No user interaction is required (UI:N) and the attack is remote over the network (AV:N) with low complexity (AC:L). The primary limiting factor is the authentication requirement (a valid low-privilege account) plus the narrow deployment footprint of this niche PHP application; there is no indication the endpoint is exploitable pre-authentication or in a default-anonymous configuration. |
| Impact | Signals are mostly low-to-moderate and internally consistent. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:L/VI:L/VA:L) yields a low base score of 2.1, driven primarily by the low impact ratings and the PR:L requirement - exploitation requires an authenticated session, not anonymous access. Exploit maturity is marked E:P (proof-of-concept), matching the reported publicly available exploit on GitHub; this is publicly available exploit code, not confirmed active exploitation. There is no CISA KEV listing and no EPSS score was provided, so no probabilistic exploitation signal is available. The most notable tension is between the signal type and the impact rating: this is a CWE-89 SQL injection, a class that frequently enables full database confidentiality compromise, yet the input rates all impacts as Low - suggesting the assigner (VulDB) scored conservatively or assessed limited reachable data. Overall this is a low-priority issue for most organizations: it is authenticated, affects a niche product, and shows no evidence of widespread or active exploitation, though the public PoC means opportunistic abuse against exposed instances is plausible. |
| Exploit ScenarioDerived | An attacker with a low-privileged authenticated account to the Simple Pharmacy Management System sends a request to /SimplePharmacy-PHP/product/delete.php with a maliciously crafted ID parameter, injecting SQL into the backend query. Because the attack vector is network-based with low complexity, the request can be issued remotely over HTTP. A public proof-of-concept exists (GitHub issue referenced by VulDB), lowering the skill barrier to reproduce the injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
SQL injection in CodeAstro Simple Pharmacy Management System 1.0 allows an authenticated remote attacker to inject arbitrary SQL through the ID parameter of /SimplePharmacy-PHP/product/delete.php, exposing and potentially altering backend database contents. Exploitation requires a valid low-privilege session (CVSS PR:L in both the vendor vector and our independent assessment), needs no user interaction, and is low complexity over the network; publicly available exploit code exists but there is no confirmation of active exploitation (not in CISA KEV). The vendor's own CVSS 4.0 score is only 2.1 given limited confidentiality/integrity/availability sub-scores and the E:P exploit-maturity flag, while our independent 3.1 assessment rates confidentiality impact High with integrity and availability Low, so real-world risk is driven mainly by the authentication prerequisite and the narrow deployment footprint of this niche PHP application.
RemediationAI
No vendor-released patch identified at time of analysis - CodeAstro has not published a fixed version of Simple Pharmacy Management System 1.0 in the available advisory data, so operators cannot rely on an upstream upgrade. Recommended compensating controls, in priority order: (1) restrict access to /SimplePharmacy-PHP/product/delete.php to authenticated administrative sessions only and remove it from any internet-facing or anonymous-reachable deployment, accepting that this limits legitimate product-deletion workflows for non-admin staff; (2) patch the source directly by replacing string-concatenated SQL with parameterized prepared statements (PDO or mysqli with bound parameters) and casting the ID argument to an integer before use, which fully removes the injection primitive at the cost of maintaining a local code fork; (3) disable or remove the delete.php endpoint entirely if product deletion is not a required business function, trading functionality for the strongest reduction in exposure; (4) deploy a WAF or reverse-proxy rule that rejects non-numeric or SQL-metacharacter-laden values on the ID parameter and blocks POST/GET requests to product/delete.php from untrusted networks, understanding that signature-based filtering is bypassable and does not fix the root cause; and (5) harden the underlying database account to least privilege (no DROP/ALTER or cross-schema access) and rotate any credentials stored in the affected database, since injected queries may have already exfiltrated them. Monitor the VulDB record at https://vuldb.com/vuln/412923 for a future vendor fix; the existing public exploit at https://github.com/yihaofuweng/cve/issues/73 should be assumed usable by any attacker who obtains a valid low-privilege login.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP-based web application - CodeAstro's Simple Pharmacy Management System, a small open-source pharmacy inventory/point-of-sale project distributed by codeastro.com and reflected in the CPE record cpe:2.3:a:codeastro:simple_pharmacy_management_system:*:*:*:*:*:*:*:* - whose /SimplePharmacy-PHP/product/delete.php script builds a SQL statement directly from the user-supplied ID parameter without parameterization or type enforcement. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw: the delete handler appears to concatenate the raw request value into a DELETE/SELECT query executed against the application's MySQL/MariaDB backend, so crafted input can terminate the literal and append attacker-controlled SQL. Because the flaw sits in a delete routine rather than a pure read path, successful injection typically leaks table contents (products, users, possibly hashed credentials) and can corrupt or remove records; stacked or UNION-based payloads could in principle extend the impact to other tables reachable by the application's database account. The upstream codebase shows no versioned patching history in the available CPE data, indicating an unmaintained or single-version release where all deployments share the same vulnerable code path.
Know when Simple Pharmacy Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network SQLi with low complexity but requires a low-privilege authenticated account (PR:L); SQL injection typically enables substantial database read (C:H) with limited write/delete impact here.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
A vulnerability was determined in CodeAstro Simple Pharmacy Management 1.0. Rated medium severity (CVSS 5.3), this vulne
SQL injection in CodeAstro Simple Pharmacy Management System 1.0 allows authenticated remote attackers to execute arbitr
Exploit-DB