Executive brief
Simple Inventory System is an open-source PHP application used to manage product inventory. The application is vulnerable to SQL injection in the delete functionality, allowing an unauthenticated attacker to extract sensitive data from the database, including user credentials, and read arbitrary files from the server. This could lead to complete compromise of the inventory system and exposure of business data and user information.
Technical details
A boolean-based blind SQL injection vulnerability exists in /InventoryManagement/delete.php where the unsanitized GET parameter "id" is directly concatenated into a SQL DELETE query. No authentication is required to exploit this vulnerability, and it is accessible over the network. An attacker can craft malicious SQL payloads in the id parameter to enumerate the database schema, extract sensitive data (including credentials), and leverage database FILE privileges to read arbitrary files from the server filesystem. The vulnerability stems from missing input validation and failure to use parameterized queries. Remediation involves implementing prepared statements with bound parameters and applying strict input validation.
Affected products
- code-projects Simple Inventory System 1.0
Timeline
- 2026-08-20: disclosed: Vulnerability publicly disclosed