Inventory Management System CVE-2026-87925

No authentication required - the CVSS 4.0 vector specifies PR:N/UI:N, confirming the endpoint is reachable by unauthenticated remote users. The vulnerable code path is the storeCustomerOrderInvoice function in includes/manage.php, triggered by submitting a POST request with the pro_name[] parameter. The application must be deployed and internet-accessible (or accessible to the attacker's network). No special configuration or non-default settings are required. Exploitation is limited by the impact scope (VC:L/VI:L/VA:L), meaning full database exfiltration or system compromise is not directly achieved through this vector alone - attackers gain partial read/write access to database contents rather than administrative or OS-level control.

The CVSS 4.0 score of 6.9 (Medium) reflects network-accessible, unauthenticated, low-complexity exploitation with limited impact across all three pillars (VC:L/VI:L/VA:L), indicating partial rather than full database compromise - attackers can read or modify some data but full database dump or system-level access is not directly implied by the score. A public PoC exists (GitHub issue #13), raising the exploitation probability beyond the theoretical. EPSS data is not provided in the input. No patch exists and the maintainer has not responded, leaving the vulnerability open-ended on a rolling-release project. Real-world risk is moderated significantly by the project's likely small and niche deployment footprint - this appears to be a personal/hobby project with limited production use. No KEV listing, no confirmed active exploitation.

An unauthenticated attacker discovers the publicly accessible inventory management application, locates the customer order invoice endpoint backed by includes/manage.php, and submits a crafted HTTP POST request with a malicious SQL payload embedded in the pro_name[] array parameter. Using the publicly available PoC from GitHub issue #13, the attacker executes stacked or UNION-based SQL queries to extract customer records, order data, or credentials stored in the database.