CVE-2026-10248: SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection
A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function createsupplier of the file /Exportcsv/export of the component Supplier Creation Interface. This manipulation of the argument Address/Company Name causes csv injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Pharmacy Sales and Inventory System /Export_csv/export (Supplier Creation Interface)from your environment.If CSV export is not required, disable or uninstall the CSV export functionality (remove or disable the file /Export_csv/export and/or the create_supplier export) until a secure fix or mitigation is implemented.
- Configuration
When generating CSV from create_supplier (file /Export_csv/export), validate and escape the Address and Company Name fields to neutralize CSV formula injection (e.g., detect fields starting with =, +, - or @ and prefix them with a single quote or otherwise escape them before writing to the CSV).
SourceCodester Pharmacy Sales and Inventory System - /Export_csv/export (Supplier Creation Interface) Address/Company Name sanitization for CSV export = escape or neutralize leading formula characters (=, +, -, @) or prefix fields with a single quote - Compensating control
Restrict access to the /Export_csv/export endpoint and related export functionality to trusted/internal IP ranges and authenticated users (apply firewall rules, network ACLs or WAF rules to block public/untrusted access) to reduce risk of remote exploitation.
- Operational
Scan existing supplier records and previously exported CSV files for fields beginning with '=', '+', '-', or '@'; sanitize or remove malicious values, regenerate sanitized exports, and notify affected users or administrators of potentially malicious entries.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10248?
The severity of CVE-2026-10248 is medium with a score of 4.7.
What is CVE-2026-10248?
CVE-2026-10248 is a vulnerability that allows for CSV injection through the create_supplier function in the SourceCodester Pharmacy Sales and Inventory System.
How do I fix CVE-2026-10248?
To fix CVE-2026-10248, validate and sanitize user input in the Supplier Creation Interface before processing it.
What impact does CVE-2026-10248 have on data integrity?
CVE-2026-10248 can lead to potential data integrity issues through CSV injection when exporting supplier data.
Who is affected by CVE-2026-10248?
CVE-2026-10248 affects users of the SourceCodester Pharmacy Sales and Inventory System up to version 1.0.