A critical SQL injection vulnerability in the code-projects Inventory Management System 1.0 allows unauthenticated attackers to bypass authentication and gain unauthorized system access.

This vulnerability is a SQL injection flaw located in the index.php file of the login component. It permits an unauthenticated attacker to manipulate the username parameter to bypass authentication controls and log in as any user.

Successful exploitation of this flaw allows an unauthorized actor to bypass authentication mechanisms entirely. This creates a high risk of unauthorized data access, potential administrative control over the inventory management application, and loss of data integrity. With a CVSS score of 7.3, this represents a significant threat to internal business operations that rely on this software for tracking assets.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the login portal using IP allowlisting or VPN requirements.

Proactive Monitoring: Review web server access logs for anomalous SQL syntax, such as single quotes, dashes, or SQL keywords within the username field of login requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Public Exploit Available: Yes — a public proof-of-concept is documented in the referenced GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a clear risk to any organization hosting this software. Organizations should prioritize isolating the affected application from public-facing networks until a vendor-supplied patch is released and applied.