# CVE-2026-79845: code-projects Simple Inventory System SQL injection in edit.php

Source: https://junglewise.ai/threats/cve-2026-79845-code-projects-simple-inventory-system-sql-injection-in-edit-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79845 · Severity: high · CVSS 7.3 · Published 2026-08-25

Simple Inventory System is a PHP-based inventory management application available for download from code-projects.org. The application contains a SQL injection vulnerability in its edit functionality that allows attackers to remotely extract sensitive data from the database, including user credentials, product information, and even arbitrary files from the server without requiring any authentication.

Technologies: [Code-Projects Simple Inventory System](https://junglewise.ai/threats/technologies/simple-inventory-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-79845 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79845 being exploited in the wild.

**How severe is CVE-2026-79845?** High severity, with a CVSS score of 7.3, published 25 August 2026.

**Which products and versions are affected?** Code-Projects Simple Inventory System 1.0.

**Is there a fix for CVE-2026-79845?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79845 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-79845?** Check whether you run Code-Projects Simple Inventory System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection flaw (CWE-89) in the /InventoryManagement/edit.php file where the POST parameter 'id' is directly concatenated into SQL queries without sanitization or parameterized query preparation. An unauthenticated attacker can craft Boolean-based blind or time-based blind SQL injection payloads to enumerate the database schema, extract user credentials and sensitive data, and read arbitrary files via MySQL FILE privileges. The attack is remotely exploitable over the network with no authentication or user interaction required. Remediation requires implementing parameterized prepared statements, input validation, and restricting database user privileges.

## Affected products

- code-projects Simple Inventory System 1.0

## Timeline

- 2026-08-25: disclosed

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://raw.githubusercontent.com/anubhavv106/Security-Advisories/refs/heads/main/Simple-Inventory-System-edit.php-SQLi.md](https://raw.githubusercontent.com/anubhavv106/Security-Advisories/refs/heads/main/Simple-Inventory-System-edit.php-SQLi.md)

## Related threats

- [code-projects Simple Inventory System cross-site scripting in user registration](https://junglewise.ai/threats/cve-2026-82625-code-projects-simple-inventory-system-cross-site-scripting-in)
- [code-projects Simple Inventory System information disclosure in database backup](https://junglewise.ai/threats/cve-2026-82624-code-projects-simple-inventory-system-information-disclosure-in)
- [code-projects Simple Inventory System SQL injection in delete.php](https://junglewise.ai/threats/cve-2026-76990-code-projects-simple-inventory-system-sql-injection-in-delete-php)