CVE-2026-10155: Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove Bdtask Multi-Store Inventory Management System Accounts Report Handler from your environment.

   Uninstall or remove the Accounts Report Handler component if it is not required by the deployment to eliminate exposure of the vulnerable accounts_report_search function.

2. Configuration

   Modify the accounts_report_search implementation to strictly validate and sanitize the dtpToDate parameter and use parameterized queries or prepared statements/ORM for all database access to eliminate SQL injection.

   Bdtask Multi-Store Inventory Management System - Accounts Report Handler (application/modules/accounts/controllers/Accounts.php) dtpToDate input handling / accounts_report_search = validate and sanitize input; use parameterized queries/prepared statements
3. Configuration

   If a code fix cannot be immediately applied, disable or remove access to the accounts_report_search endpoint/feature (Accounts Report Handler) until the vulnerability is fixed.

   Bdtask Multi-Store Inventory Management System - Accounts Report Handler (application/modules/accounts/controllers/Accounts.php) accounts_report_search endpoint availability = disabled
4. Compensating control

   Apply compensating controls while a code fix is developed: restrict access to the accounts_report_search endpoint to trusted IP ranges, place the application behind a WAF with SQL injection rules enabled, and block requests that submit unexpected dtpToDate values.

5. Operational

   Because a public exploit exists, review application and web server logs for suspicious activity targeting accounts_report_search/dtpToDate, rotate any credentials or API keys that may have been exposed, and restore affected systems from known-good backups if compromise is detected.

Event History

Frequently Asked Questions