A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

A SQL injection vulnerability has been identified in rabindralamsal's inventory-management-system version 1.0.0. The flaw exists in the index.php file within the Login component, where manipulation of the username and/or password arguments can lead to SQL injection. The vulnerability is remotely exploitable, meaning an attacker does not need local access to the system. A public exploit has already been published, increasing the risk of active exploitation. The affected product is a web-based inventory management application. No authentication is required to exploit the vulnerability, as it resides in the login functionality. This represents a significant risk to organizations running this software version.