Sales Inventory System CVE-2026-78171

The target login page /pages/processlogin.php must be reachable over the network - no authentication is required prior to exploitation because this is the pre-authentication login endpoint itself. CVSS 4.0 confirms PR:N (no privileges required) and UI:N (no user interaction). No special feature flag, non-default configuration, or specific platform is required; any default deployment of Sales and Inventory System 1.0 with the web server accessible over a network is vulnerable in its out-of-the-box state. Exploitation is limited to network-reachable instances - deployments strictly bound to localhost or isolated internal segments with no external access path have reduced but not eliminated exposure, depending on attacker lateral movement capability within the network.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P (proof-of-concept exploit exists) describes a low-complexity, unauthenticated, remotely exploitable vulnerability with no required user interaction - the most accessible attacker-favorable profile short of confirmed active exploitation. Impact is rated low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no downstream system impact, yielding a score of 6.9. The relatively modest impact score likely reflects that itsourcecode applications are typically single-tenant, small-footprint deployments rather than systems holding high-value enterprise data. EPSS data was not provided in the input and cannot be inferred. This CVE is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. However, the login-endpoint attack surface, absence of authentication requirements, minimal attack complexity, and availability of a public POC on GitHub collectively represent a real operational risk for any internet-exposed deployment. The niche prevalence of the product limits aggregate exposure across the internet, but individual instances should treat this as high priority.

An attacker discovers an internet-exposed instance of Sales and Inventory System 1.0 and sends a crafted HTTP POST request to /pages/processlogin.php with a SQL injection payload in the User field (e.g., a classic ' OR '1'='1'-- bypass). The unsanitized value is concatenated into the backend SQL authentication query, causing it to return a truthy result and granting the attacker unauthorized access without valid credentials. A public proof-of-concept demonstrating this technique is referenced at https://github.com/MounT1veR/new/issues/1.