{"id":"CVE-2026-71248","published":"2026-08-05T11:16:27.863","lastModified":"2026-08-10T12:17:27.410","description":"Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = \"select * from user where email = '' and password = ''\", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Harsh21Patel/Inventory-Management-System-PHP","tags":[]},{"url":"https://github.com/Harsh21Patel/Inventory-Management-System-PHP/pull/3","tags":[]}],"exploitRefs":[{"url":"https://github.com/Harsh21Patel/Inventory-Management-System-PHP","tags":[]},{"url":"https://github.com/Harsh21Patel/Inventory-Management-System-PHP/pull/3","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw is an SQL injection vulnerability due to direct string concatenation in login.php, allowing attackers to bypass authentication by manipulating input parameters.","exploitability":"Exploitation is relatively easy given public references and requires only crafting a specific payload to bypass authentication checks.","blast_radius":"If exploited, this could grant unauthorized access to the entire system, leading to data theft or other malicious activities.","remediation":"Update login.php to use parameterized queries or prepared statements to prevent SQL injection attacks.","tags":["sql-injection","auth-bypass","web","rce"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:43:20.750Z"}}