CVE-2026-76785
Received Received - Intake

SQL Injection in Mini-Inventory-and-Sales-Management-System

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulDB

Description
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76785
EUVD
EUVD-2026-63188

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amirsanni mini_inventory_and_sales_management_system 0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection flaw in the Mini-Inventory-and-Sales-Management-System version 0.1. It exists in the Transaction::getAll() function of the application/models/Transaction.php file. The issue occurs when user-controlled parameters orderBy and orderFormat are directly interpolated into SQL queries without proper sanitization, allowing attackers to manipulate database queries remotely.

Detection Guidance

Check if the vulnerable application (Mini-Inventory-and-Sales-Management-System 0.1) is installed by inspecting the file application/models/Transaction.php for the Transaction::getAll() method. Look for direct SQL query interpolation without escaping, particularly in SQLite3 mode. Test for SQL injection by sending crafted GET requests to the Transactions::latr_() endpoint with parameters orderBy and orderFormat containing malicious SQL expressions like CASE WHEN statements.

Impact Analysis

An authenticated attacker could exploit this to perform SQL injection attacks, potentially extracting sensitive data such as administrator password hashes or other confidential information from the database. The attack can be executed remotely over the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using this system may face compliance violations, potential data breaches, and associated legal penalties if exploited.

Mitigation Strategies

Immediately upgrade to a patched version if available. If not, modify the Transaction::getAll() method in application/models/Transaction.php to use parameterized queries instead of direct string interpolation. Ensure the application uses MySQL instead of SQLite3 by updating application/config/database.php. Apply input validation and sanitization for all user-controlled parameters in the Transactions::latr_() endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76785. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart