Executive brief
SourceCodester's Inventory and Monitoring System is a PHP-based web application used to track inventory and monitor operations. An attacker can inject malicious SQL commands through the login form's username field to bypass authentication, extract sensitive data from the database, modify records, or take complete control of the system without requiring valid credentials.
Technical details
A SQL injection vulnerability exists in the /index.php file where the 'username' parameter is concatenated directly into SQL queries without sanitization or parameterized statements. The vulnerability is unauthenticated and remotely exploitable via POST requests to the login form. An attacker can craft payloads using boolean-based blind, error-based, stacked queries, or time-based blind SQL injection techniques to extract database contents, modify data, or execute arbitrary database commands. The issue affects version 1.0; patches are not mentioned in available sources.
Affected products
- SourceCodester Inventory and Monitoring System 1.0
Timeline
- 2026-08-20: disclosed: Vulnerability disclosed on GitHub
- 2026-09-16: advisory: CVE-2026-92405 published