Description
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function order_by of the file DB_query_builder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-09-27
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Assess Impact
AI Analysis

Impact

The flaw resides in the order_by function of DB_query_builder.php. An attacker can craft a malicious orderBy parameter that is inserted directly into a SQL statement, allowing arbitrary SQL injection. Remote exploitation is possible, and public exploits exist. This vulnerability can lead to unauthorized data disclosure, modification, or database compromise, affecting confidentiality and integrity of the stored data.

Affected Systems

The issue affects amirsanni Mini-Inventory-and-Sales-Management-System versions up to commit 81bf0b55f5933f3b0dbb1583204a612e06605b95. No newer releases are available as the project is no longer maintained and follows a rolling release model. Consequently, any deployed instance of the system built from the affected code base remains vulnerable.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate risk. EPSS data is not available, but the vulnerability is listed as not in the KEV catalog. Public exploits have been released, so an attacker can abuse the flaw from the Internet. Because the product is abandoned, the exposure window is limited to systems that still run the vulnerable code. The attack vector is remote and does not require privileged access.

Generated by OpenCVE AI on September 28, 2026 at 00:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Migrate the inventory management system to a maintained alternative or appoint a developer to apply a fix to the order_by function, ensuring the value is properly validated or parameterized.
  • Implement strict input validation on the orderBy parameter, accepting only a predefined list of column names and order directions.
  • Restrict database connectivity to the application host by using firewall rules or network segmentation, limiting the ability of external actors to reach the database.

Generated by OpenCVE AI on September 28, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 27 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function order_by of the file DB_query_builder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer.
Title amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection
First Time appeared Amirsanni
Amirsanni mini-inventory-and-sales-management-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:amirsanni:mini-inventory-and-sales-management-system:*:*:*:*:*:*:*:*
Vendors & Products Amirsanni
Amirsanni mini-inventory-and-sales-management-system
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Amirsanni Mini-inventory-and-sales-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-28T12:53:53.976Z

Reserved: 2026-09-27T07:31:48.396Z

Link: CVE-2026-100887

cve-icon Vulnrichment

Updated: 2026-09-28T12:53:49.860Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T00:16:32.273

Modified: 2026-09-28T15:16:04.793

Link: CVE-2026-100887

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T02:00:17Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')