CVE-2026-87925: Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname[] results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be initiated remotely and requires no privileges or user interaction according to the supplied vector. Exploitation involves manipulating the pro_name[] argument passed to storeCustomerOrderInvoice in includes/manage.php.
Are deployments affected by default, and which releases should be treated as vulnerable?
The available data identifies the project through commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and states that rolling releases are used. No affected or fixed release versions are available, so version-based exclusion is not supported by the provided information.
How urgent is remediation?
The exploit is public, and the issue is rated high severity with low attack complexity and network reachability. Prioritize systems that expose the affected order-invoice functionality to remote users.
Has a vendor fix or response been confirmed?
No. The project was reportedly notified through an issue report but had not responded, and no updated release details are provided.