CVE-2026-10255: Pharmacy Sales System Auth Bypass Flaw

CVE-2026-10255 Overview

CVE-2026-10255 is an improper access control vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0. The flaw resides in the sell_statement function within the application/controllers/ShowForm.php file. An unauthenticated remote attacker can invoke this function over the network without prior authorization. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The weakness is classified under [CWE-266] Incorrect Privilege Assignment and affects the confidentiality of sales statement data exposed by the controller.

Critical Impact
Remote, unauthenticated access to the sell_statement controller endpoint allows attackers to retrieve restricted sales information without valid credentials or session context.

Affected Products

SourceCodester Pharmacy Sales and Inventory System 1.0
application/controllers/ShowForm.php (function sell_statement)
Deployments exposing the affected PHP application over HTTP/HTTPS

Discovery Timeline

2026-06-01 - CVE-2026-10255 published to the National Vulnerability Database (NVD)
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10255

Vulnerability Analysis

The vulnerability stems from missing access control enforcement on the sell_statement function exposed through the ShowForm.php CodeIgniter-style controller. The application fails to verify the caller's session, role, or privilege level before serving the underlying sales statement data. As a result, any network-reachable client can invoke the endpoint and receive sensitive information that should be restricted to authenticated pharmacy staff.

Because the affected component is a web controller, exploitation requires only standard HTTP requests and no specialized tooling. The CWE-266 categorization reflects incorrect privilege assignment, where a public-facing route was granted access equivalent to authenticated users. The disclosed Exploit Prediction Scoring System data places this issue in the lower exploitation likelihood range, but public disclosure of the exploit pattern materially raises real-world risk.

Root Cause

The controller method sell_statement does not invoke an authentication or authorization check before executing its business logic. Frameworks like CodeIgniter require developers to explicitly attach session or role guards either in the constructor or per-method. The absence of these guards on ShowForm.php produces a broken access control condition that downgrades a privileged operation to a public one.

Attack Vector

An attacker reaches the vulnerable function by issuing an unauthenticated HTTP request to the controller route that maps to sell_statement. No user interaction, prior credential theft, or chained vulnerability is required. The attack surface is the entire network reachable from the internet or internal segments hosting the application. Refer to the GitHub CVE Issue Discussion and VulDB CVE-2026-10255 for the disclosed request pattern.

No verified proof-of-concept code is reproduced here. Technical details are available in the VulDB Submission Report and the VulDB #367533 CTI records.

Detection Methods for CVE-2026-10255

Indicators of Compromise

Unauthenticated HTTP requests to URIs containing ShowForm/sell_statement or equivalent route mappings.
Web server access logs showing successful 200 responses to sell_statement from clients without a valid session cookie.
Anomalous outbound traffic from the application host following access to sales statement endpoints.

Detection Strategies

Correlate web server logs against authentication session stores to flag responses served without an authenticated session identifier.
Deploy web application firewall (WAF) rules that require session validation headers on /ShowForm/ controller paths.
Hunt for repeated enumeration of controller methods originating from a single source IP within short time windows.

Monitoring Recommendations

Forward Apache, Nginx, or IIS access logs to a centralized analytics platform and alert on access to sell_statement outside business hours.
Track HTTP 200 responses with empty Referer and missing session cookies to the affected PHP application.
Review database query logs for sales statement queries triggered without a preceding authenticated login event.

How to Mitigate CVE-2026-10255

Immediate Actions Required

Restrict network exposure of the Pharmacy Sales and Inventory System 1.0 application to trusted networks or VPN until a fix is applied.
Add a server-side authentication check to the sell_statement method that rejects requests lacking a valid authenticated session.
Audit other methods within ShowForm.php for the same missing-guard pattern and remediate consistently.

Patch Information

No official vendor patch is referenced in the available advisories. Administrators should monitor the SourceCodester Security Resource and the GitHub CVE Issue Discussion for updates. Until a vendor fix is published, apply the source-level guard described above and validate it with regression testing.

Workarounds

Place the application behind a reverse proxy that enforces authentication at the gateway layer for all /ShowForm/ routes.
Implement a CodeIgniter pre-controller hook that validates session state and redirects unauthenticated requests to the login flow.
Disable or remove the sell_statement route if it is not actively required by business operations.

bash

# Configuration example: Nginx location block restricting the vulnerable controller
location ~* /ShowForm/sell_statement {
    # Require an upstream auth subrequest before proxying
    auth_request /auth/validate;
    error_page 401 = @login_redirect;
    proxy_pass http://pharmacy_app_backend;
}

location @login_redirect {
    return 302 /login;
}