Executive brief
An inventory management system used to track product stock and process customer orders contains a SQL injection vulnerability in its order processing function. An unauthenticated attacker can manipulate product names during order creation to execute arbitrary SQL commands, allowing them to alter inventory stock levels across all products, create fraudulent invoices, and potentially access or modify sensitive database records.
Technical details
The vulnerability is a classic SQL injection flaw in the storeCustomerOrderInvoice() function within includes/manage.php. The root cause is unsanitized concatenation of user-supplied product names (pro_name[] parameter) directly into UPDATE SQL statements without prepared statements, escaping, or input validation. The vulnerable code constructs queries like: UPDATE products SET product_stock = '0' WHERE product_name = 'X' OR 1=1#, where the attacker-controlled product name is injected. The endpoint (includes/process.php) does not require authentication, allowing remote attackers to invoke the vulnerability. Exploitation allows arbitrary modification of product stock values, invoice fraud, and potential database exfiltration or destruction. The project uses continuous delivery with rolling releases and no version information is available; the maintainer was notified but has not yet responded or patched the issue.
Affected products
- Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f
Timeline
- 2026-07-30: disclosed: Issue reported on GitHub
- 2026-09-10: other: CVE-2026-87925 published; advisory indicates no vendor response