CVE-2026-100887: amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Deployments of amirsanni Mini-Inventory-and-Sales-Management-System that include the affected Database Query Builder code are exposed. The maintainer states that affected products are no longer supported.
What level of access does an attacker need?
Exploitation is remote and has low attack complexity, but requires low-level privileges. No user interaction is required.
How likely is exploitation in practice?
A public exploit has been released and may be used in attacks. The vulnerability can affect confidentiality, integrity, and availability at a low impact level.
Is a fixed version available?
No updated release or fixed version is provided because the project uses a rolling-release approach. The maintainer has indicated that the project has not been maintained and may not be fixed.