CVE-2026-10235: CodeAstro Ingredients Stock Management SQL Injection Vulnerability

Technical summary

CVE-2026-10235 is a SQL injection flaw (CWE-89, CWE-74) affecting CodeAstro Ingredients Stock Management System 1.0. The vulnerability exists in stock_manager.php where the txt_search_category input parameter is not properly sanitized before use in SQL queries. An authenticated remote attacker can craft malicious SQL payloads to bypass query logic, exfiltrate data, or modify database contents. The CVSS v3.1 score of 6.3 reflects network accessibility combined with the requirement for prior authentication. Public exploit code is available, increasing practical exploitation risk.

Business impact

Organizations deploying CodeAstro Ingredients Stock Management System 1.0 face potential data breaches involving inventory records, supplier information, and possibly customer data stored in the application database. Attackers with valid credentials—whether obtained through phishing, credential reuse, or insider access—can silently access or corrupt stock data, leading to inventory discrepancies, supply chain disruption, and compliance violations. The public availability of exploit code lowers the barrier to opportunistic attacks by less-skilled threat actors.

Affected systems

CodeAstro Ingredients Stock Management System version 1.0 is the confirmed affected release. Organizations should audit deployments of this product immediately. The vulnerability applies to all instances regardless of deployment environment (on-premises, cloud-hosted, or hybrid). Systems with network exposure and active user accounts are at highest risk.

Exploitability

Exploitation requires valid authentication credentials to access the application, which moderately raises the attack barrier compared to unauthenticated vulnerabilities. However, the flaw is trivial to exploit once authenticated—standard SQL injection payloads applied to the txt_search_category parameter will work reliably. The published exploit reduces development time for attackers. Threat actors can abuse compromised or weak employee accounts, or combine this flaw with credential-harvesting campaigns targeting organizations known to use the product.

Remediation

Upgrade to a patched version released by CodeAstro following this advisory. Verify patch availability and version numbers directly from the vendor's security advisory or release notes. Until patching is possible, implement strict input validation on the txt_search_category parameter by using parameterized queries or prepared statements. Apply database access controls to limit query scope and implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns.

Patch guidance

Contact CodeAstro for official patch information and deployment guidance specific to your version and environment. Verify patch availability before scheduling maintenance windows. Test patches in a staging environment mirroring your production configuration. After patching, confirm the fix by re-testing with known SQL injection payloads in a controlled setting. Document patch application date and version for compliance records.

Detection guidance

Monitor application logs for unusual SQL syntax in txt_search_category parameters, including SQL keywords (UNION, SELECT, OR, AND) within user input. Review database query logs for unexpected or high-volume queries originating from authenticated sessions. Set up alerts for failed login attempts followed by successful authentication, which may indicate credential compromise. Use Web Application Firewall logs to identify blocked SQL injection attempts. Endpoint Detection and Response (EDR) tools can flag suspicious database activity patterns.

Why prioritize this

Although the CVSS score is moderate (6.3), the combination of public exploit availability, authenticated-but-easy exploitation, and potential for data exfiltration or manipulation warrant prompt attention. Organizations should prioritize patching within 2–4 weeks based on inventory criticality and the presence of sensitive data in the application database. Exposure assessment should identify which user accounts have active access to the system.

Risk score, explained

The CVSS v3.1 score of 6.3 (MEDIUM) reflects: network accessibility (AV:N) lowering friction; low attack complexity (AC:L) due to straightforward SQL injection; requirement for prior login (PR:L) limiting attack surface; no scope change (S:U); and confidentiality, integrity, and availability impacts all at low level (C:L/I:L/A:L). The moderate score does not account for the published exploit, which increases practical risk beyond the base metric.

Frequently asked questions