CVE-2026-71207

9.8 CRITICALpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows direct SQL injection due to unparameterized query construction and hardcoded credentials, enabling unauthorized access.
Exploitability: Exploitation is relatively easy with basic SQL knowledge; requires access to login.php script.
Blast radius: If exploited, can lead to full system compromise, data theft, or manipulation of inventory records.
Prioritized remediation: Parameterize SQL queries and remove hardcoded credentials from the application code.

rcesql-injectionauth-bypasswebsecurity

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Public exploit & PoC references

https://github.com/mrswapnilsahu/Stock-Inventory-Management-System/blob/master/login.php

All references

https://github.com/mrswapnilsahu/Stock-Inventory-Management-System/blob/master/login.php

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.