CVE-2026-10155
SQL Injection in Bdtask Multi-Store Inventory Management System
Publication date: 2026-05-31
Last updated on: 2026-05-31
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bdtask | multi-store_inventory_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-10155 is a SQL injection vulnerability found in the Multi-Store Inventory Management System version 1.0 by Bdtask. It exists in the function accounts_report_search within the file application/modules/accounts/controllers/Accounts.php, specifically affecting the dtpToDate parameter.
An authenticated admin attacker can exploit this vulnerability by injecting malicious SQL queries through the dtpToDate input field. This happens because the system improperly handles user input in SQL queries, using string interpolation instead of parameterized queries.
Exploitation can lead to unauthorized data extraction, modification, or deletion.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized access to sensitive data such as user credentials (including MD5-hashed passwords).
An attacker could also modify or delete data within the system or potentially write files to the server, which could lead to further compromise.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the `dtpToDate` parameter in the `accounts_report_search()` function for SQL injection flaws. Since exploitation requires authenticated admin access, detection involves attempting to inject SQL payloads into the `dtpToDate` input field while authenticated.
A possible approach is to use tools like sqlmap or manual curl commands to send crafted requests to the vulnerable endpoint and observe if SQL errors or unexpected data are returned.
- Example curl command to test injection (replace URL and authentication details accordingly):
- curl -X POST -d "dtpToDate=' OR '1'='1" -b "session=admin_session_cookie" https://target-system/application/modules/accounts/controllers/Accounts.php?function=accounts_report_search
- Use sqlmap with authentication cookies to automate detection: sqlmap -u "https://target-system/application/modules/accounts/controllers/Accounts.php" --data="dtpToDate=2026-05-31" --cookie="session=admin_session_cookie" --risk=3 --level=5
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable function to trusted administrators only and monitoring for suspicious activity involving the `dtpToDate` parameter.
Since the vulnerability arises from improper input handling, applying input validation and using parameterized queries or prepared statements in the affected code is critical.
If a patch or update from the vendor is available, apply it promptly. Otherwise, consider temporarily disabling or restricting the vulnerable functionality until a fix is implemented.
Additionally, review and rotate any potentially compromised credentials and monitor logs for exploitation attempts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This SQL injection vulnerability allows an authenticated admin attacker to extract, modify, or delete sensitive data, including user credentials. Such unauthorized access and potential data breaches can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring data integrity.
Failure to properly handle user input and prevent SQL injection can result in exposure of confidential data, violating principles of data confidentiality and security mandated by these standards.