CVE-2026-71248
Severity CVSS v4.0:
Pending analysis
Type:
CWE-89
SQL Injection
Publication date:
05/08/2026
Last modified:
05/08/2026
Description
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select * from user where email = '$email' and password = '$password'", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -. Separately, delete.php executes mysqli_query($db, "DELETE FROM product WHERE product_id=" . $_GET['id']) with no authentication check and no validation of the id parameter, allowing an unauthenticated attacker to delete arbitrary product rows or perform blind SQL injection via payloads such as id=0 OR SLEEP(5).
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL