Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select * from us…

CVE-2026-71248 affects the Inventory-Management-System-PHP application, exposing two critical SQL injection vulnerabilities. The first is in login.php, where raw POST parameters are directly concatenated into an authentication query without escaping or parameterization, allowing full authentication bypass via classic SQL injection payloads such as ' OR 1=1 LIMIT 1-- -. The second vulnerability exists in delete.php, which executes a DELETE SQL query using an unsanitized GET parameter with no authentication check, enabling unauthenticated attackers to delete arbitrary product records. The delete.php endpoint also allows blind SQL injection via time-based payloads like id=0 OR SLEEP(5). Both issues stem from a complete lack of input validation, prepared statements, or access controls. These vulnerabilities represent serious risks of data destruction, unauthorized access, and database enumeration.