CVE-2026-36947: Repair Shop Management System SQLi Flaw

CVE-2026-36947 Overview

Sourcecodester Computer and Mobile Repair Shop Management System v1.0 contains a SQL Injection vulnerability in the file /rsms/admin/services/view_service.php. This vulnerability allows authenticated attackers with high privileges to extract sensitive information from the database by injecting malicious SQL queries through user-controlled input parameters.

Critical Impact

Authenticated attackers with administrative privileges can exploit this SQL Injection flaw to read sensitive data from the backend database, potentially exposing customer information, repair records, and system configurations.

Affected Products

• Oretnom23 Computer and Mobile Repair Shop Management System v1.0
• Systems using the vulnerable /rsms/admin/services/view_service.php endpoint

Discovery Timeline

• 2026-04-13 - CVE-2026-36947 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-36947

Vulnerability Analysis

This SQL Injection vulnerability exists within the view_service.php file of the administrative services module. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling attackers to manipulate database operations. While the attack requires network access and high-level privileges (administrative access), successful exploitation allows unauthorized read access to confidential database contents.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that the application constructs SQL statements using user-controllable inputs without adequate validation or parameterization.

Root Cause

The root cause of this vulnerability is improper input validation and the use of unsanitized user input directly within SQL queries. The view_service.php script accepts parameters that are concatenated into database queries without proper escaping, prepared statements, or parameterized queries. This coding practice allows malicious SQL syntax to be interpreted and executed by the database engine.

Attack Vector

The attack vector is network-based, requiring authenticated access with administrative privileges. An attacker must first gain access to the administrative panel, then navigate to or directly request the vulnerable view_service.php endpoint with crafted SQL injection payloads. The injection point allows extraction of database information through techniques such as UNION-based queries, boolean-based blind injection, or time-based blind injection depending on the application's response behavior.

Exploitation involves crafting malicious input that breaks out of the intended query structure and appends additional SQL commands. For detailed technical analysis and proof-of-concept information, refer to the GitHub Exploit Details.

Detection Methods for CVE-2026-36947

Indicators of Compromise

• Unusual SQL error messages in application logs originating from view_service.php
• Access logs showing requests to /rsms/admin/services/view_service.php with suspicious query parameters containing SQL keywords (UNION, SELECT, OR, AND, --, etc.)
• Database audit logs indicating unusual query patterns or unauthorized data access attempts
• Abnormal data extraction volumes from service-related database tables

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common SQL injection patterns targeting the affected endpoint
• Configure intrusion detection systems (IDS) to alert on requests containing SQL metacharacters in URL parameters
• Enable detailed logging for the administrative services module and monitor for injection attempts
• Deploy database activity monitoring to identify anomalous query patterns

Monitoring Recommendations

• Set up alerts for HTTP requests to view_service.php containing encoded or obfuscated SQL syntax
• Monitor authentication logs for privileged account access followed by suspicious service module activity
• Establish baseline metrics for normal database query behavior and alert on deviations
• Review web server access logs periodically for reconnaissance activity targeting the admin panel

How to Mitigate CVE-2026-36947

Immediate Actions Required

• Restrict network access to the administrative panel to trusted IP addresses only
• Implement additional authentication controls for sensitive administrative functions
• Review and audit all administrator account credentials for potential compromise
• Consider temporarily disabling the view_service.php functionality until a patch is applied

Patch Information

No official vendor patch has been released for this vulnerability. The software is maintained by oretnom23 on Sourcecodester. Organizations using this application should monitor the official project page and security disclosure report for updates. Given the lack of vendor support, consider implementing manual code fixes or migrating to actively maintained alternatives.

Workarounds

• Implement input validation and parameterized queries in the affected view_service.php file to prevent SQL injection
• Deploy a web application firewall (WAF) with rules to filter malicious SQL injection payloads
• Limit administrative access to the minimum necessary users and enforce strong authentication
• Consider network segmentation to isolate the application from untrusted networks
• Regularly backup database contents to enable recovery in case of data manipulation

# Example: Restrict access to admin panel via .htaccess
<Directory "/var/www/html/rsms/admin">
    Order deny,allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>