CVE-2026-71248
CriticalCVSS 9.8Summary
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters, allowing authentication bypass via SQL injection. Separately, delete.php executes a DELETE query with no authentication check and no validation of the id parameter, allowing unauthenticated deletion of arbitrary product rows or blind SQL injection.
Risk Assessment
An attacker can bypass authentication, gain unauthorized access to data, and delete or modify database records, potentially leading to data integrity and availability issues.
Recommendation
Apply patches immediately or implement parameterized SQL queries and add validation and authentication for all database operations.
Original NVD description (English source)
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select * from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -. Separately, delete.php executes mysqli_query($db, "DELETE FROM product WHERE product_id=" . $_GET['id']) with no authentication check and no validation of the id parameter, allowing an unauthenticated attacker to delete arbitrary product rows or perform blind SQL injection via payloads such as id=0 OR SLEEP(5).