Description

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-20T14:18:00.313Z",
  "pubdate": "2026-08-20T14:18:00.313Z",
  "executiveSummary": "A security vulnerability has been identified in code-projects Simple Inventory System version 1.0, specifically within the /delete.php endpoint. The flaw is classified as a SQL Injection (SQLi) vulnerability, arising from improper sanitization and validation of user-supplied input passed via the ID parameter.\nThe vulnerability allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL payloads directly into the vulnerable parameter. Successful exploitation of this flaw can lead to unauthorized access, extraction, modification, or deletion of sensitive database contents, potentially compromising the integrity and confidentiality of the entire inventory management infrastructure.\nGiven that exploits for this vulnerability have been publicly disclosed, the risk level is critical. Immediate remediation is required to secure the application against remote exploitation. Attackers do not require prior administrative privileges or complex authentication mechanisms to launch the attack, provided they have network access to the target deployment.",
  "technicalDetails": "The vulnerability resides in the /delete.php script of code-projects Simple Inventory System 1.0. The root cause of the issue is the insecure handling of HTTP request parameters where user input supplied through the ID argument is concatenated directly into SQL query strings without prior parameterization, sanitization, or strong typing.\nAttack flow begins when an attacker crafts a malicious HTTP GET or POST request targeting /delete.php, appending a specially crafted SQL payload to the ID parameter. Because the application fails to utilize prepared statements or parameterized queries, the database query interpreter executes the injected SQL commands alongside or instead of the intended deletion logic.\nThe vulnerable component is the database interaction layer within the backend processing of /delete.php. The network exposure is remote, meaning any external user capable of reaching the web server can initiate the attack vector. Authentication requirements are absent or minimal, lowering the threshold for malicious actors to execute database-level commands.\nPayload behavior typically involves out-of-band data exfiltration, union-based extraction of internal database schemas, or destructive SQL commands such as DROP TABLE, depending on the attacker's intent and database privileges. The post-exploitation impact includes complete database compromise, data leakage, and potential arbitrary file read or write capabilities if the underlying database management system is misconfigured with excessive OS-level privileges."
}