CVE-2026-10248: CSV Injection in SourceCodester Pharmacy Sales and Inventory System

Technical summary

CVE-2026-10248 is a CSV injection vulnerability (CWE-74, CWE-1236) in the Supplier Creation Interface of SourceCodester Pharmacy Sales and Inventory System up to version 1.0. The vulnerability exists in the create_supplier function within the /Export_csv/export component. The Address and Company Name parameters are not properly sanitized before being written to CSV exports, allowing an authenticated high-privilege user to inject formula sequences (e.g., =, +, -, @) that execute arbitrary operations when the file is parsed by spreadsheet software. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) reflects network accessibility with high privilege requirement and no user interaction beyond the administrator's actions.

Business impact

This vulnerability poses moderate risk to pharmacy operations. A malicious or compromised high-privilege user account can export supplier records containing embedded formulas that execute when staff open reports in Excel or similar tools. This can lead to unauthorized command execution on administrative workstations, exfiltration of sensitive prescription or inventory data, or manipulation of supplier records. The confidentiality, integrity, and availability impacts are limited (L/L/L) but compounded by the healthcare data sensitivity typical in pharmacy systems and the reliance on exported reports for regulatory compliance and financial reconciliation.

Affected systems

SourceCodester Pharmacy Sales and Inventory System versions up to and including 1.0 are vulnerable. No patched version information has been disclosed publicly; verify with SourceCodester for availability of a security update. The vulnerability requires authenticated access with administrative or supplier-management privileges, limiting the attack surface to internal users or accounts that have been compromised.

Exploitability

Exploitation requires valid high-privilege credentials and administrative access to the supplier creation interface. The attack is straightforward—an authenticated admin or high-privilege user simply enters a formula (e.g., =cmd|'/c calc'!A1) in the Address or Company Name field, then exports supplier data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last update; however, proof-of-concept information has been publicly disclosed, increasing the risk of opportunistic attacks by insiders or those with lateral movement access to admin accounts.

Remediation

Update SourceCodester Pharmacy Sales and Inventory System to a patched version when available; contact the vendor directly for security advisories and release timelines. As an interim control, restrict export functionality to a minimal set of trusted administrators, implement monitoring on export activities (particularly high-volume or unusual exports), and educate staff to disable automatic formula evaluation in spreadsheet applications. Apply principle of least privilege to supplier management accounts.

Patch guidance

Monitor SourceCodester's security advisories and release notes for a patch addressing CSV injection in the export functionality. Verify the fix against the vendor's official advisory to confirm it sanitizes the Address and Company Name fields before CSV output. Test patches in a non-production environment before deployment to ensure compatibility with your pharmacy workflows and any downstream report integrations. Once a patch is available, prioritize deployment to systems handling sensitive supplier or inventory data.

Detection guidance

Monitor access logs for unusual patterns in supplier creation or export activities, particularly late-night or off-hours exports by administrative accounts. Search application logs and CSV export files for indicators of formula injection: entries beginning with =, +, -, @, or tab characters in Address or Company Name fields. Implement file integrity monitoring on exported CSV reports to detect unexpected changes. Log all export operations with user, timestamp, and record count to establish a baseline for anomalous activity. Network-level monitoring is less effective here since the vulnerability is triggered by authenticated actions; focus on access control and logging within the application.

Why prioritize this

Although this vulnerability has a CVSS score of 4.7 (MEDIUM), it warrants prompt attention in healthcare environments due to the sensitivity of pharmacy data, the established proof-of-concept disclosure, and the potential for insider threats or compromised admin accounts to cause significant operational disruption or compliance violations (HIPAA, state pharmacy regulations). The high privilege requirement reduces immediate external threat but increases insider risk—a priority for most pharmacy operations.

Risk score, explained

The CVSS 3.1 score of 4.7 reflects: (1) Network Attack Vector—vulnerable via the web interface; (2) Low Attack Complexity—no special conditions needed to trigger the injection; (3) High Privilege Requirement—only admin/high-privilege accounts can exploit; (4) No User Interaction—the admin performing the export is the attacker; (5) Low impact on Confidentiality, Integrity, and Availability—formula execution can leak data or corrupt processes, but not wholesale system compromise. In pharmacy contexts, the contextual risk is elevated due to regulated data and operational criticality, even though the numeric score remains MEDIUM.

Frequently asked questions