CVE-2026-76785: amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and requires low privileges. No user interaction is required.
Which inputs are involved in the injection?
The affected Transaction::getAll function in application/models/Transaction.php is vulnerable when the orderBy or orderFormat argument can be manipulated.
Is public exploit information available?
Yes. An exploit has been publicly released, increasing the likelihood that the issue may be used in attacks.
Has the project provided a fix or response?
The project was notified through an issue report but had not responded at the time of publication. No fix information is provided.