# CVE-2026-10155: Bdtask Multi-Store Inventory Management System SQL injection in Accounts Report Handler

Source: https://junglewise.ai/threats/cve-2026-10155-bdtask-multi-store-inventory-management-system-sql-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-31. Updated: 2026-05-31  
License: CC BY 4.0 with a link back

CVE-2026-10155 · Severity: medium · CVSS 4.7 · Published 2026-05-31

A security vulnerability exists in the Bdtask Multi-Store Inventory Management System, a software platform used for managing retail inventory and accounting. An attacker with administrative access can exploit a flaw in the reporting tools to run unauthorized database commands. This could lead to the exposure of sensitive business data, modification of financial records, or disruption of the inventory system.

Vendors: [Bdtask](https://junglewise.ai/threats/vendors/bdtask).

## Quick answers

**Is CVE-2026-10155 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10155 being exploited in the wild.

**How severe is CVE-2026-10155?** Medium severity, with a CVSS score of 4.7, published 31 May 2026.

**Which products and versions are affected?** Bdtask Multi-Store Inventory Management System 1.0.

**Is there a fix for CVE-2026-10155?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10155 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10155?** Check whether you run Bdtask Multi-Store Inventory Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in Bdtask Multi-Store Inventory Management System 1.0 within the Accounts Report Handler component. The flaw is located in the accounts_report_search() function in application/modules/accounts/controllers/Accounts.php. The root cause is the improper neutralization of the 'dtpToDate' POST parameter, which is directly interpolated into a SQL query string within the Accounts_model.php file using CodeIgniter's Query Builder where() method without parameterization. An attacker with high privileges (admin-level) can exploit this remotely to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification. A public exploit has been disclosed.

## Affected products

- Bdtask Multi-Store Inventory Management System 1.0

## Timeline

- 2026-05-04: disclosed: Vulnerability discovered by Kevin Chiang
- 2026-05-31: advisory: NVD/VulDB advisory published

## References

- [https://github.com/kevin57545/CVE/blob/main/README.md](https://github.com/kevin57545/CVE/blob/main/README.md)
- [https://vuldb.com/submit/818863](https://vuldb.com/submit/818863)
- [https://vuldb.com/vuln/367408](https://vuldb.com/vuln/367408)
- [https://vuldb.com/vuln/367408/cti](https://vuldb.com/vuln/367408/cti)

## Related threats

- [Bdtask Multi-Store Inventory Management System unrestricted upload in Module.php](https://junglewise.ai/threats/cve-2026-10172-bdtask-multi-store-inventory-management-system-unrestricted)