Description

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-20T01:16:54.100Z",
  "pubdate": "2026-08-20T01:16:54.100Z",
  "executiveSummary": "An SQL Injection vulnerability has been identified in the amirsanni Mini-Inventory-and-Sales-Management-System version 0.1. The flaw exists within the Transaction::getAll function located in application/models/Transaction.php, specifically due to improper neutralization of user-supplied input passed via the orderBy and orderFormat parameters.\nThis security deficiency allows remote attackers to manipulate database query structures by injecting malicious SQL commands. Successful exploitation of this vulnerability can lead to unauthorized data exposure, data modification, or complete database compromise, severely impacting the confidentiality, integrity, and availability of the affected system.\nThe attack can be initiated remotely without requiring prior authentication or privileged access, posing significant risk implications given that exploit details have been publicly released. The project maintainers have been notified via an issue report but have not yet provided a vendor patch or response.",
  "technicalDetails": "The vulnerability resides in the Transaction::getAll function within the application/models/Transaction.php file of the amirsanni Mini-Inventory-and-Sales-Management-System version 0.1. The root cause of the flaw is the direct concatenation or improper sanitization of parameters—specifically orderBy and orderFormat—into dynamic SQL query strings executed against the underlying database backend.\nFrom an attack flow perspective, a remote, unauthenticated adversary targets the vulnerable endpoint associated with the Transaction::getAll function. By supplying crafted malicious payloads within the orderBy or orderFormat HTTP request parameters, the attacker breaks out of the intended SQL query syntax. Because the application fails to utilize parameterized queries, prepared statements, or strict input whitelisting for sorting parameters, the database engine interprets the injected strings as executable SQL commands.\nThe network exposure of this vulnerability is remote, enabling external threat actors to interact with the application over the network and launch automated or manual exploit vectors. No prior authentication or specific privilege levels are required to reach the vulnerable code path, lowering the barrier to entry for potential attackers.\nPayload behavior during successful exploitation typically involves database enumeration via error-based, boolean-based, or time-based SQL injection techniques, or data exfiltration through union-based queries. Depending on database user privileges, post-exploitation impact could extend from reading sensitive transaction and inventory records to executing administrative database operations or interacting with the underlying operating system."
}