{"id":"CVE-2026-71207","published":"2026-08-05T08:16:42.717","lastModified":"2026-08-10T12:17:24.480","description":"The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mrswapnilsahu/Stock-Inventory-Management-System/blob/master/login.php","tags":[]}],"exploitRefs":[{"url":"https://github.com/mrswapnilsahu/Stock-Inventory-Management-System/blob/master/login.php","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows direct SQL injection due to unparameterized query construction and hardcoded credentials, enabling unauthorized access.","exploitability":"Exploitation is relatively easy with basic SQL knowledge; requires access to login.php script.","blast_radius":"If exploited, can lead to full system compromise, data theft, or manipulation of inventory records.","remediation":"Parameterize SQL queries and remove hardcoded credentials from the application code.","tags":["rce","sql-injection","auth-bypass","web","security"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:42:58.128Z"}}