Bug 302 - "SQL Injection input in Delivery Note Number is not sanitized/rejected — raw SQL error exposed "
Summary: "SQL Injection input in Delivery Note Number is not sanitized/rejected — raw ...
Status: OPEN
Alias: None
Product: Smartwas
Classification: Unclassified
Component: Purchase (show other bugs)
Version: unspecified
Hardware: PC Windows
: --- Medium
Assignee: Arun (Arun)
URL:
Depends on:
Blocks:
 
Reported: 2026-07-09 09:23 UTC by Karunakaran (Karunakaran)
Modified: 2026-07-09 09:24 UTC (History)
0 users

See Also:
Associated Test Case ID:
Triaged By: ---
Root Cause Analysis (RCA):
Resolution Summary / Fix Details:
Impact Area:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Karunakaran (Karunakaran) 2026-07-09 09:23:52 UTC 
"Entering a SQL injection payload in the Delivery Note Number field is not rejected or sanitized by the system. Instead of showing a validation error, the system throws an unhandled SQL error, indicating the input reaches the database layer without sanitization.
"