Pet Shop Management System SQL Injection Flaws

SQL injection in the admin_reject_completed.php script of itsourcecode Pet Shop Management System 1.0 lets an attacker who can reach the administrative back-office area manipulate the ID parameter to inject arbitrary SQL against the application's database, enabling unauthorized reads and modifications of stored data. Exploitation is network-reachable but requires at least low-privileged authenticated access to the admin interface (CVSS:4.0 PR:L, no user interaction), and the accompanying CVSS 4.0 vector carries an E:P exploit-maturity flag consistent with the public disclosure of working exploit code; there is no indication of confirmed active exploitation (not in CISA KEV). The issue is real but moderate-priority: it is bounded to version 1.0 deployments whose admin scripts are exposed to the attacker, and no vendor patch has been identified at time of analysis.

SQL injection in itsourcecode Pet Shop Management System 1.0 allows an authenticated, low-privilege user to manipulate the 'filter' parameter of admin_reservefilter.php and inject arbitrary SQL into the backend query, exposing or altering database contents with low impact to confidentiality, integrity and availability. The flaw is remotely reachable over the network with no user interaction, but requires a valid session on the application's administrative component, so risk is concentrated in deployments that expose the admin panel or run the product in production. Publicly available exploit code exists for this issue, though there is no confirmation of active exploitation; the practical risk is further limited by the narrow real-world deployment base of this educational PHP product.