inventory-management-system CVE-2026-87924

The includes/invoice_bill.php file must be directly accessible via HTTP/S from the attacker's network position - exploitation is blocked if the web server restricts direct access to the includes/ directory. No authentication, session token, or prior account access is required (CVSS 4.0 PR:N/UI:N). Exploitation is limited by: (1) the application must be actively deployed and network-reachable; (2) the web server must not block direct requests to include-path files; and (3) impact is confined to the Invoice Generation component - attackers can only manipulate order_date and invoice_no fields, with no confirmed path to confidentiality compromise or full application takeover based on available data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) places no authentication or network-access preconditions on exploitation - any client that can reach the web server can invoke the vulnerable endpoint. Impact is constrained: VC:N/VI:L/VA:L indicates no confidentiality exposure; only limited integrity and availability impact, meaning an attacker can tamper with invoice parameters but cannot exfiltrate credentials or data. The E:P modifier confirms a public proof-of-concept exists, reducing the skill threshold for exploitation. CISA KEV has not listed this CVE, and EPSS data was not provided in the source intelligence, so exploitation probability cannot be precisely quantified. Real-world risk is bounded by the product's extremely limited production footprint - this appears to be a personal hobby project rather than an enterprise platform, meaning even a mid-sized municipal IT team in zabrze is unlikely to be running it. For any organization that has deployed this system to handle financial records, however, the ability to forge or alter invoice dates and numbers without authentication represents a meaningful integrity risk that could enable billing fraud or audit trail falsification.

An unauthenticated attacker identifies a publicly deployed instance of the inventory-management-system and sends a crafted HTTP GET or POST request directly to includes/invoice_bill.php with manipulated order_date and invoice_no values - no session cookie or login credential is required. With the public POC available via GitHub issue #14, the attacker can alter invoice records to falsify billing dates, duplicate invoice numbers, or corrupt financial audit trails. The attack requires only network reachability to the web server and knowledge of the endpoint path.