Behruzbek Zokiraliyev

**Name of the Vulnerable Software and Affected Versions** Stock-Inventory-Management-System (affected versions not specified) **Description** The `login.php` endpoint is susceptible to authentication bypass. The application assigns raw `$ POST` values from the `username` and `password` variables to the `$ SESSION` and concatenates these values directly into a SQL statement without parameterization or escaping. This allows an unauthenticated remote attacker to bypass authentication using SQL injection payloads. Additionally, the script contains hardcoded administrative credentials (admin/neola) within a post-login conditional check, creating another path for full authentication bypass. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.