CVE-2025-3694 is a High severity (CVSS 7.3) SQL injection in the SourceCodester Web-based Pharmacy Product Management System 1.0. The login_email parameter of the login handler is the weak point. The record names no fix, so restrict access and parameterise the query.
What's affected
The record names SourceCodester Web-based Pharmacy Product Management System 1.0. The vulnerable code is the login handler, through the login_email parameter.
The record names no fixed version, and I found no vendor advisory. Treat the product as unpatched until its maker says otherwise.
How to check if you're exposed
Start by finding out whether you run the product. Check web server document roots, container images and old project folders for it, and look at the version in the admin area or the installed files.
If you do run it, review web server and database logs for unusual requests to that page, especially ones containing quote characters, SQL keywords or very long values in the parameter. Unexpected database errors in the application log are another sign. Do not test the flaw against a system you do not own.
What to do now
- Locate every copy of the application, including test and demo installs.
- Take it off the internet or put it behind a VPN or an IP allow list until it is fixed.
- Ask the vendor or project for a fix, and watch the advisory sources for one.
- If you can change the code, switch the query to a parameterised statement and validate the value as the type it should be.
- Use a database account with only the access the application needs, so a flaw cannot reach other data.
- Back up the database, and review it and your logs for signs of tampering.
Why it matters
The weakness is CWE-74 (Injection), CWE-89 (SQL Injection). The application builds a database query by joining text that comes from the request into the SQL statement. Because the database cannot tell the developer's SQL from the attacker's text, crafted input changes what the query does. The usual impact is reading or changing data in the database, and sometimes more.
The vector is network, low complexity, no privileges and no interaction, with low impact on each of confidentiality, integrity and availability, giving 7.3. The flaw sits in the login handler, which is reachable before anyone has signed in. That is the reason no privileges are needed.
A login form that is open to SQL injection puts the authentication step itself at risk, and not only the data behind it. A pharmacy system holds stock and sales records, and possibly customer details. The record says the exploit has been disclosed to the public.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is a login flaw worse?
It can be reached with no account, and it affects the check that is supposed to keep outsiders out.
What is the fix?
Use a parameterised query for the login lookup and store passwords as salted hashes. The record names no vendor fix.
Sources
Last reviewed: 18 October 2026.
