The Stock‑Inventory‑Management‑System login script accepts raw username and password values from the web form and assigns them directly to session variables without validation. It then concatenates those values into a SQL query, creating a classic injection point. An attacker can supply a payload such as \' OR \'1\='1 in the login form to satisfy the WHERE clause and gain access without knowing a valid account. In addition, the script contains hard‑coded administrative credentials (admin/neola) in a post‑login check, providing a completely independent bypass pathway. The weakness is a classic CWE‑89 SQL Injection that leads to unrestricted authentication bypass.

The affected product is Stock‑Inventory‑Management‑System from vendor mrswapnilsahu. No version information is listed, so the vulnerability exists in the current codebase that contains login.php as distributed in the repository linked in the references.

With a CVSS score of 9.8 the risk level is Critical. The EPSS score is not available, implying historical data is lacking, but the exploit is trivial: an unauthenticated remote attacker can submit a crafted login form and gain full access via SQL injection or hard‑coded credentials. The vulnerability is not listed in CISA’s KEV catalog, but the lack of mitigation makes it highly attractive for exploitation. Had the EPSS been available, it would likely be in the higher tier, but even without it the exploitation effort is negligible due to the absence of access controls or code obfuscation.