Description (CNA)
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Harsh21Patel / Inventory-Management-System-PHP | affected 0 |
CWE
CWE-89
References
- https://github.com/Harsh21Patel/Inventory-Management-System-PHP
- https://github.com/Harsh21Patel/Inventory-Management-System-PHP/pull/3
ADP enrichment
No English description supplied.
No references supplied.