CVE-2026-4779
Published: 24 March 2026
Summary
CVE-2026-4779 is a medium-severity Injection (CWE-74) vulnerability in Ahsanriaz26Gmailcom Sales And Inventory System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4779 is a SQL injection vulnerability in SourceCodester Sales and Inventory System 1.0. The issue resides in the processing of the file update_customer_details.php within the HTTP GET Parameter Handler component, where manipulation of the 'sid' argument enables SQL injection (CWE-74, CWE-89). Published on 2026-03-24, it carries a CVSS v3.1 base score of 6.3.
The vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L), no user interaction (UI:N), and unchanged scope (S:U). Attackers can achieve low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) through SQL injection via the 'sid' parameter.
Advisories reference a public proof-of-concept on GitHub at https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateCustomerDetails-sid.md demonstrating the exploitation. VulDB entries (https://vuldb.com/?ctiid.352797, https://vuldb.com/?id.352797, https://vuldb.com/?submit.775172) document the issue, and the vendor site is at https://www.sourcecodester.com/. No specific patches or mitigations are detailed in the provided references.
The exploit has been disclosed publicly and may be used.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15029
Vulnerability details
A security vulnerability has been detected in SourceCodester Sales and Inventory System 1.0. This issue affects some unknown processing of the file update_customer_details.php of the component HTTP GET Parameter Handler. Such manipulation of the argument sid leads to sql injection.…
more
The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in remotely accessible web app (update_customer_details.php via 'sid' GET param) directly enables T1190 exploitation of public-facing applications and facilitates T1213.006 unauthorized database data access/manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the 'sid' HTTP GET parameter to ensure it conforms to expected formats, preventing SQL injection exploitation in update_customer_details.php.
Enforces restrictions on information inputs like the 'sid' parameter at system boundaries, blocking malicious SQL payloads via type, source, and volume limits.
Requires identification, reporting, and correction of the SQL injection flaw in the Sales and Inventory System's HTTP GET Parameter Handler.