Executive Summary

CVE-2026-10155 is a SQL injection vulnerability found in the Multi-Store Inventory Management System version 1.0 by Bdtask. It exists in the function accounts_report_search within the file application/modules/accounts/controllers/Accounts.php, specifically affecting the dtpToDate parameter.

An authenticated admin attacker can exploit this vulnerability by injecting malicious SQL queries through the dtpToDate input field. This happens because the system improperly handles user input in SQL queries, using string interpolation instead of parameterized queries.

Exploitation can lead to unauthorized data extraction, modification, or deletion.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized access to sensitive data such as user credentials (including MD5-hashed passwords).

An attacker could also modify or delete data within the system or potentially write files to the server, which could lead to further compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the `dtpToDate` parameter in the `accounts_report_search()` function for SQL injection flaws. Since exploitation requires authenticated admin access, detection involves attempting to inject SQL payloads into the `dtpToDate` input field while authenticated.

A possible approach is to use tools like sqlmap or manual curl commands to send crafted requests to the vulnerable endpoint and observe if SQL errors or unexpected data are returned.

• Example curl command to test injection (replace URL and authentication details accordingly):
• curl -X POST -d "dtpToDate=' OR '1'='1" -b "session=admin_session_cookie" https://target-system/application/modules/accounts/controllers/Accounts.php?function=accounts_report_search
• Use sqlmap with authentication cookies to automate detection: sqlmap -u "https://target-system/application/modules/accounts/controllers/Accounts.php" --data="dtpToDate=2026-05-31" --cookie="session=admin_session_cookie" --risk=3 --level=5

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable function to trusted administrators only and monitoring for suspicious activity involving the `dtpToDate` parameter.

Since the vulnerability arises from improper input handling, applying input validation and using parameterized queries or prepared statements in the affected code is critical.

If a patch or update from the vendor is available, apply it promptly. Otherwise, consider temporarily disabling or restricting the vulnerable functionality until a fix is implemented.

Additionally, review and rotate any potentially compromised credentials and monitor logs for exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

This SQL injection vulnerability allows an authenticated admin attacker to extract, modify, or delete sensitive data, including user credentials. Such unauthorized access and potential data breaches can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring data integrity.

Failure to properly handle user input and prevent SQL injection can result in exposure of confidential data, violating principles of data confidentiality and security mandated by these standards.

Useful 0 Not Useful 0