CVE-2026-10235: CodeAstro Ingredients Stock Management System stock_manager.php sql injection
A flaw has been found in CodeAstro Ingredients Stock Management System 1.0. This vulnerability affects unknown code of the file /Ingredients-Stock/stockmanager.php. This manipulation of the argument txtsearchcategory causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
CodeAstro Ingredients Stock Management System 1.0from your environment.If the application is not required, uninstall or disable CodeAstro Ingredients Stock Management System 1.0 to eliminate the vulnerable component until a secure fix is available.
- Configuration
Modify /Ingredients-Stock/stock_manager.php to stop embedding txt_search_category directly into SQL. Use prepared statements/parameterized queries and perform strict input validation/whitelisting or proper escaping to prevent SQL injection.
/Ingredients-Stock/stock_manager.php (CodeAstro Ingredients Stock Management System) SQL handling for parameter txt_search_category = use parameterized queries / validate and sanitize input - Compensating control
Until the code is fixed, block or restrict access to the vulnerable endpoint (/Ingredients-Stock/stock_manager.php) with network controls (WAF/firewall/ACL) or limit access to trusted IPs to prevent remote exploitation of the txt_search_category parameter.
- Operational
Investigate logs for indicators of exploitation targeting stock_manager.php; if compromise is suspected, contain the incident and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10235?
CVE-2026-10235 has a medium severity rating of 6.3.
What type of vulnerability is CVE-2026-10235?
CVE-2026-10235 is classified as an SQL Injection vulnerability.
How can CVE-2026-10235 be exploited?
CVE-2026-10235 can be exploited remotely through manipulated input in the txt_search_category argument.
What software is affected by CVE-2026-10235?
CVE-2026-10235 affects CodeAstro Ingredients Stock Management System version 1.0.
How do I fix CVE-2026-10235?
To fix CVE-2026-10235, sanitize and validate user inputs in the stock_manager.php file to prevent SQL injection.