# CVE-2026-87925: Rizwan17 inventory-management-system SQL injection in order processing

Source: https://junglewise.ai/threats/cve-2026-87925-rizwan17-inventory-management-system-sql-injection-in-order  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87925 · Severity: high · CVSS 7.3 · Published 2026-09-10

An inventory management system used to track product stock and process customer orders contains a SQL injection vulnerability in its order processing function. An unauthenticated attacker can manipulate product names during order creation to execute arbitrary SQL commands, allowing them to alter inventory stock levels across all products, create fraudulent invoices, and potentially access or modify sensitive database records.

## Quick answers

**Is CVE-2026-87925 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87925 being exploited in the wild.

**How severe is CVE-2026-87925?** High severity, with a CVSS score of 7.3, published 10 September 2026.

**Which products and versions are affected?** Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.

**Is there a fix for CVE-2026-87925?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87925 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-87925?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a classic SQL injection flaw in the storeCustomerOrderInvoice() function within includes/manage.php. The root cause is unsanitized concatenation of user-supplied product names (pro_name[] parameter) directly into UPDATE SQL statements without prepared statements, escaping, or input validation. The vulnerable code constructs queries like: UPDATE products SET product_stock = '0' WHERE product_name = 'X' OR 1=1#, where the attacker-controlled product name is injected. The endpoint (includes/process.php) does not require authentication, allowing remote attackers to invoke the vulnerability. Exploitation allows arbitrary modification of product stock values, invoice fraud, and potential database exfiltration or destruction. The project uses continuous delivery with rolling releases and no version information is available; the maintainer was notified but has not yet responded or patched the issue.

## Affected products

- Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f

## Timeline

- 2026-07-30: disclosed: Issue reported on GitHub
- 2026-09-10: other: CVE-2026-87925 published; advisory indicates no vendor response

## References

- [https://github.com/Rizwan17/inventory-management-system/](https://github.com/Rizwan17/inventory-management-system/)
- [https://github.com/Rizwan17/inventory-management-system/issues/13](https://github.com/Rizwan17/inventory-management-system/issues/13)