CVE-2026-86211
Received Received - Intake

SQL Injection in RabindraLamsal Inventory-Management-System

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86211
EUVD
EUVD-2026-72101

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rabindralamsal inventory-management-system 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in the inventory-management-system 1.0.0. It exists in the login logic of the index.php file where user-supplied username and password values are directly concatenated into SQL queries without proper sanitization or parameterized queries. This allows attackers to manipulate SQL statements remotely without authentication.

Detection Guidance

To detect this SQL injection vulnerability, test the login endpoint with crafted inputs. Use tools like curl to send requests with malicious payloads such as ' OR '1'='1' -- or time-based payloads like admin' AND SLEEP(5)--. Monitor responses for delays or unexpected behavior indicating successful injection.

Impact Analysis

This vulnerability can allow attackers to bypass authentication and gain unauthorized access to the system. They could manipulate SQL queries to extract sensitive data, modify or delete database records, or execute administrative commands. The attack can be performed remotely without any prior authentication.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive personal or health data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful SQL injection could result in unauthorized data access, leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately update the inventory-management-system to use parameterized queries instead of direct SQL string concatenation. Sanitize all user inputs and implement strict input validation for username and password fields. Consider disabling the vulnerable component if a patch is unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart