Mini Inventory And Sales Management System
Monthly
Stored cross-site scripting in the Items Management Module of amirsanni Mini Inventory and Sales Management System allows an authenticated low-privileged user to inject script through the itemName argument in application/controllers/Items.php, which executes in another user's browser when the affected item page is viewed. The issue affects all versions under the project's rolling-release model (CPE wildcard), with no vendor response or released fix identified, and no public exploit code identified at time of analysis. Risk is integrity-focused client-side script execution requiring victim interaction; CVSS 4.0 scores it 5.1 while the 3.1 assessment is consistent with low-to-moderate real-world impact.
Authenticated SQL injection in the order_by() method of DB_query_builder.php in amirsanni's Mini-Inventory-and-Sales-Management-System lets a remote attacker holding valid low-privilege credentials manipulate the orderBy argument and inject arbitrary SQL into the ORDER BY clause of generated queries, yielding high-confidence read access to database contents (customer, inventory and sales records, application credentials) and limited data-manipulation potential. Publicly available exploit code exists, but the injection sits in an ORDER BY context, which constrains extraction to blind/inferential or error-based techniques rather than direct UNION result dumping, and an authenticated session is required. The project is abandoned - the maintainer has said it is not worth fixing and follows a rolling release model, so no version-specific patched build is expected; exposure is limited to the small existing deployment base, making this a genuine but low real-world priority.
SQL injection in amirsanni Mini-Inventory-and-Sales-Management-System 0.1 allows authenticated remote attackers to manipulate the orderBy and orderFormat parameters of the Transaction::getAll function to inject arbitrary SQL and read or modify database contents. The project maintainer has not responded to responsible disclosure, leaving the vulnerability unpatched. A public exploit exists via GitHub issue #101; no confirmed active exploitation (not in CISA KEV), but the low bar for exploitation given POC availability elevates near-term risk for any deployed instances.
Stored cross-site scripting in the Items Management Module of amirsanni Mini Inventory and Sales Management System allows an authenticated low-privileged user to inject script through the itemName argument in application/controllers/Items.php, which executes in another user's browser when the affected item page is viewed. The issue affects all versions under the project's rolling-release model (CPE wildcard), with no vendor response or released fix identified, and no public exploit code identified at time of analysis. Risk is integrity-focused client-side script execution requiring victim interaction; CVSS 4.0 scores it 5.1 while the 3.1 assessment is consistent with low-to-moderate real-world impact.
Authenticated SQL injection in the order_by() method of DB_query_builder.php in amirsanni's Mini-Inventory-and-Sales-Management-System lets a remote attacker holding valid low-privilege credentials manipulate the orderBy argument and inject arbitrary SQL into the ORDER BY clause of generated queries, yielding high-confidence read access to database contents (customer, inventory and sales records, application credentials) and limited data-manipulation potential. Publicly available exploit code exists, but the injection sits in an ORDER BY context, which constrains extraction to blind/inferential or error-based techniques rather than direct UNION result dumping, and an authenticated session is required. The project is abandoned - the maintainer has said it is not worth fixing and follows a rolling release model, so no version-specific patched build is expected; exposure is limited to the small existing deployment base, making this a genuine but low real-world priority.
SQL injection in amirsanni Mini-Inventory-and-Sales-Management-System 0.1 allows authenticated remote attackers to manipulate the orderBy and orderFormat parameters of the Transaction::getAll function to inject arbitrary SQL and read or modify database contents. The project maintainer has not responded to responsible disclosure, leaving the vulnerability unpatched. A public exploit exists via GitHub issue #101; no confirmed active exploitation (not in CISA KEV), but the low bar for exploitation given POC availability elevates near-term risk for any deployed instances.