EUVD-2026-53204
GHSA-8924-6725-h379
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote login bypass via trivial SQLi and hardcoded creds gives full application read/write, so AV:N/AC:L/PR:N/UI:N with high C/I/A.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password values to $_SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can submit a payload such as ' OR '1'='1 in the login form to bypass authentication entirely. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.
Articles & Coverage 1
AnalysisAI
Authentication bypass in mrswapnilsahu's Stock-Inventory-Management-System (PHP) lets an unauthenticated remote attacker log in as any user by injecting SQL through the login form. The login.php script concatenates raw POST username/password into the auth query (CWE-89) and also ships hardcoded admin credentials (admin/neola), giving two independent full-bypass paths. No public exploit identified at time of analysis, though the trivial ' OR '1'='1 payload is described directly in the disclosure.
Technical ContextAI
The affected component is a PHP-based inventory web application backed by a SQL database. In login.php the application assigns unsanitized $_POST['username'] and $_POST['password'] directly into $_SESSION and then builds the authentication SQL statement by string concatenation with no prepared statements, parameter binding, or escaping. This is a textbook CWE-89 SQL Injection: attacker-controlled input crosses into the query's syntactic context, so a tautology such as ' OR '1'='1 forces the WHERE clause to always evaluate true and returns a valid session. Compounding this, a post-login conditional compares against static hardcoded administrative credentials (admin/neola), a CWE-798-style flaw baked into source that any reader of the public repository can see.
RemediationAI
No vendor-released patch identified at time of analysis; the only reference (https://github.com/mrswapnilsahu/Stock-Inventory-Management-System/blob/master/login.php) points to the vulnerable source, not a fixed release. Remediate at the code level: rewrite the login query in login.php to use parameterized/prepared statements (PDO or mysqli with bound parameters) so username/password can never alter query structure, and stop assigning raw $_POST values into $_SESSION. Remove the hardcoded admin/neola credential entirely and replace it with properly hashed credentials stored in the database (password_hash/password_verify). As interim compensating controls if the code cannot be changed immediately: place the application behind a WAF rule blocking SQL meta-characters and tautology patterns on the login endpoint (trade-off: pattern-based rules are bypassable and may break legitimate logins containing quote characters), and restrict network access to the login page via IP allowlisting or VPN (trade-off: reduces convenience and does not fix the hardcoded credential for anyone with reachable access). Given the severity, taking the instance offline until the code is fixed is the safest option.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today