A critical SQL injection vulnerability in the rabindralamsal inventory-management-system login portal allows unauthenticated attackers to bypass authentication and gain unauthorized access.

The application is vulnerable to SQL injection within the index.php file, where the username and password parameters are directly concatenated into SQL queries without proper sanitization or parameterization. This flaw allows an unauthenticated remote attacker to manipulate database queries to bypass the login mechanism entirely.

Successful exploitation of this vulnerability grants an attacker unauthorized access to the inventory management system, potentially leading to the compromise of sensitive organizational data. Given the CVSS score of 7.3, this high-severity flaw poses a significant risk to data integrity and system confidentiality. Unauthorized access could result in the exfiltration of inventory records or the manipulation of business processes managed by the software.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the login portal using firewall rules or VPNs. Contact the vendor for updates or consider migrating to a more secure alternative if the software is no longer maintained.

Proactive Monitoring: Review web server access logs for anomalous POST requests to index.php that contain SQL syntax, such as sleep commands or boolean-based injection patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in the username and password fields.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

This vulnerability represents a significant security risk because it allows for trivial authentication bypass. Organizations currently running rabindralamsal inventory-management-system version 1.0.0 must treat this as a priority, implementing immediate network-level restrictions to prevent unauthorized access while awaiting a permanent vendor-supplied fix.