CVE-2026-71248 Details

A vulnerability in the Inventory Management System PHP application allows for authentication bypass and SQL injection. The issue arises in the login.php file, where the authentication query is constructed by directly concatenating raw POST parameters without proper escaping or parameterization. This flaw enables attackers to bypass authentication by using payloads such as email=' OR 1=1 LIMIT 1-- -. Additionally, the delete.php file allows unauthenticated users to delete arbitrary product rows or execute blind SQL injection. The vulnerability in delete.php stems from the absence of authentication checks and the lack of validation for the id parameter, which can be exploited with payloads like id=0 OR SLEEP(5).

Users are advised to update the application to the latest version, where this vulnerability has been addressed. The fixed version can be found in the GitHub repository under the 'fix/sql-injection' branch.