EUVD-2026-53321
GHSA-w54w-xf28-wf79
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
delete.php is remotely reachable with no auth, no user interaction, and low complexity; blind SQLi enables data extraction (C:H), arbitrary deletion (I:H), and data destruction (A:H).
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
3DescriptionCVE.org
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select * from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -. Separately, delete.php executes mysqli_query($db, "DELETE FROM product WHERE product_id=" . $_GET['id']) with no authentication check and no validation of the id parameter, allowing an unauthenticated attacker to delete arbitrary product rows or perform blind SQL injection via payloads such as id=0 OR SLEEP(5).
AnalysisAI
SQL injection in the Inventory-Management-System-PHP application (Harsh21Patel GitHub project) allows unauthenticated attackers to fully bypass authentication and destructively manipulate the product database. login.php concatenates raw POST email/password into its query, so a payload like email=' OR 1=1 LIMIT 1-- - logs in as the first user, while delete.php runs a DELETE on an unsanitized GET id parameter with no auth check, enabling arbitrary row deletion and blind SQLi. No public exploit identified at time of analysis, though the advisory itself publishes working payloads; the flaw carries CVSS 9.8 and is not listed in CISA KEV.
Technical ContextAI
The application is a small PHP + MySQL (mysqli) inventory CRUD app. The root cause class is CWE-89 (SQL Injection): both vulnerable endpoints build SQL by direct string interpolation of client-controlled input with no escaping (mysqli_real_escape_string), no parameterization (prepared statements), and no type validation. In login.php the query 'select * from user where email = '$email' and password = '$password'' is subverted with a tautology plus 'LIMIT 1' to force exactly one returned row, satisfying the $count == 1 gate and turning the authentication check into an authentication bypass. In delete.php the integer product_id is concatenated directly ('DELETE FROM product WHERE product_id=' . $_GET['id']), so payloads such as '0 OR 1=1' delete all rows and time-based payloads such as '0 OR SLEEP(5)' create a blind boolean/time-based SQLi oracle. The database user is configured as MySQL 'root' with an empty password, maximizing the blast radius of any injection. No specific CPE strings were supplied in the input.
RemediationAI
Apply the upstream fix from pull request #3 (https://github.com/Harsh21Patel/Inventory-Management-System-PHP/pull/3), which converts both queries to parameterized prepared statements ($con->prepare / bind_param) and casts the delete id to an integer; the fix is delivered as a PR/commit rather than a tagged release, so a released patched version is not independently confirmed and operators should merge or cherry-pick the commit directly. Beyond the code fix, add a server-side authentication/session check to delete.php (and all state-changing endpoints), since it currently performs deletes with no auth gate at all. As compensating controls until patched: restrict access to delete.php via web-server ACLs or authentication middleware (trade-off: may break legitimate admin flows if session handling is not wired up); change the MySQL account away from root-with-empty-password to a least-privilege user lacking DROP/broad DELETE rights (trade-off: requires re-testing app DB operations); and place a WAF rule to block SQL meta-characters and tautology patterns on the email, password, and id parameters (trade-off: pattern-based rules are bypassable and can cause false positives).
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today