Detections
Analytics
CVE-2026-71248
critical
Description
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select * from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -. Separately, delete.php executes mysqli_query($db, "DELETE FROM product WHERE product_id=" . $_GET['id']) with no authentication check and no validation of the id parameter, allowing an unauthenticated attacker to delete arbitrary product rows or perform blind SQL injection via payloads such as id=0 OR SLEEP(5).
References
https://github.com/Harsh21Patel/Inventory-Management-System-PHP/pull/3
https://github.com/Harsh21Patel/Inventory-Management-System-PHP