The Stock-Inventory-Management-System's login.php script is vulnerable to SQL Injection (CWE-89) because it builds its authentication SQL query by directly concatenating raw username and password values from session variables without any parameterization or escaping. This flaw enables attackers to inject malicious SQL code to bypass authentication or manipulate the database. Furthermore, the presence of hardcoded administrative credentials (admin/neola) in a post-login conditional check creates a second, independent authentication bypass path. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating network exploitable, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a high level. No patch or official remediation guidance is currently available.

An attacker can exploit the SQL Injection vulnerability to bypass authentication controls, potentially gaining unauthorized administrative access. The hardcoded administrative credentials provide an additional direct authentication bypass, increasing the risk of full system compromise. This leads to complete loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to avoid using the affected application in production environments. If use is unavoidable, restrict access to trusted users only and monitor for suspicious activity related to authentication attempts. Remediation should include parameterizing SQL queries and removing hardcoded credentials.