Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f AJAX Backend includes/process.php DBOperation.addCategory userid missing authentication

Summaryinfo

A vulnerability identified as critical has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. This manipulation of the argument userid causes missing authentication. The identification of this vulnerability is CVE-2026-87922. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Detailsinfo

A vulnerability has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and classified as critical. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument userid with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality, integrity, and availability.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-87922. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known.

It is possible to download the exploit at github.com. It is declared as proof-of-concept. The project was informed of the problem early through an issue report but has not responded yet. By approaching the search of inurl:includes/process.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Rizwan17

Name

• inventory-management-system

Version

• bfe78a330d01bb26b9daec5dc9ecd5c77900e03f

Website

• Product: https://github.com/Rizwan17/inventory-management-system/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #911128: Rizwan17 inventory-management-system bfe78a330d01bb26b9daec5dc9ecd5c77900e03f Missing Authorization (by RongJinHui)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion