SQL Injection Vulnerability in SourceCodester Simple Invoice Generator System

CVE-2024-8560

Summary

A significant SQL injection vulnerability has been identified in the SourceCodester Simple Invoice Generator System version 1.0. This vulnerability arises from improper validation of input parameters within the '/save_invoice.php' file, specifically in the handling of invoice-related fields such as invoice_code, customer, cashier, total_amount, discount_percentage, discount_amount, and tendered_amount. Malicious actors can exploit this vulnerability to execute arbitrary SQL commands, potentially allowing unauthorized access to sensitive data or manipulation of the underlying database. The vulnerability can be exploited remotely, raising serious security concerns for users of the product. Prompt action is advised to mitigate the risks associated with this critical security flaw.

References