Computer Repair Shop Management System
Monthly
SQL injection in SourceCodester Computer Repair Shop Management System 1.0 exposes the `/classes/Master.php?f=delete_product` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit has been disclosed on GitHub. Impact is assessed as limited (VC:L/VI:L/VA:L) with no scope change to subsequent systems, though the availability of exploit code meaningfully lowers the bar for opportunistic abuse of any internet-exposed instance.
SQL injection in SourceCodester Computer Repair Shop Management System 1.0 exposes the `/classes/Master.php?f=delete_product` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit has been disclosed on GitHub. Impact is assessed as limited (VC:L/VI:L/VA:L) with no scope change to subsequent systems, though the availability of exploit code meaningfully lowers the bar for opportunistic abuse of any internet-exposed instance.