提交 #897074: inventory-management-system v1.0.0 SQL Injection

rabindralamsal/inventory-management-system has a SQL Injection leading to Authentication Bypass Vulnerability. The login logic in `index.php` directly concatenates user-controlled `username` and `password` values into SQL statements without parameterized queries or escaping.
The login logic in `index.php` directly concatenates user-controlled `username` and `password` values into SQL statements without parameterized queries or escaping.

Relevant code pattern:

```php
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username = '$username'";
$result = $connect->query($sql);

$password = md5($password);
$mainSql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$mainResult = $connect->query($mainSql);
```

The `username` parameter is not filtered in this process, resulting in SQL injection vulnerabilities.

• 来源: ⚠️ https://github.com/yingxiujie/cve/issues/8
• 用户: yingxiujie (UID 96521)
• 提交: 2026-07-20 08時34分 (2 月前)
• 管理: 2026-09-05 20時44分 (2 months later)
• 状态: 已接受
• VulDB条目: 399347 [rabindralamsal inventory-management-system 1.0.0 Login index.php username/password SQL注入]
• 积分: 20