Based on the description, it is inferred that the attacker can use the login form as the attack vector. The Stock‑Inventory‑Management‑System login.php takes username and password directly from the login form, assigns these raw values to session variables, and then constructs a SQL query by concatenating those session values without any parameterization or escaping. This creates a classic injection point where an attacker can supply an SQL payload through the login form to bypass authentication. In addition, the same script contains hard‑coded administrative credentials (admin/neola) in a post‑login conditional, providing a second, independent full‑authentication‑bypass path. The weakness is a classic CWE‑89 SQL Injection that enables unrestricted access.

The affected product is Stock‑Inventory‑Management‑System from vendor mrswapnilsahu. No version information is listed, so the vulnerability exists in the current codebase that contains login.php as distributed in the repository linked in the references.

With a CVSS score of 9.8 the risk level is Critical. The EPSS score is 0.00701, indicating a low but non‑zero exploitation probability. An unauthenticated remote attacker can submit a crafted login form and gain full access via SQL injection or hard‑coded credentials. The vulnerability is not listed in CISA’s KEV catalog, but the lack of mitigation makes it highly attractive for exploitation. Even with a low EPSS, the exploitation effort remains negligible due to the absence of access controls or code obfuscation.