The vulnerability arises from unsafe SQL query construction in Inventory-Management-System-PHP. In login.php, user input for email and password is concatenated directly into the SQL query, enabling attackers to bypass authentication by injecting payloads such as email=' OR 1=1 LIMIT 1-- -. In delete.php, the product_id parameter is used directly in a DELETE SQL statement without validation or authentication checks, allowing unauthenticated attackers to delete arbitrary product entries or perform blind SQL injection via payloads like id=0 OR SLEEP(5). This results in full compromise of confidentiality, integrity, and availability of the affected system.

Successful exploitation can lead to complete authentication bypass, unauthorized deletion of product data, and potential denial of service through blind SQL injection. The vulnerability affects confidentiality, integrity, and availability of the Inventory-Management-System-PHP application. The CVSS score of 9.8 reflects critical impact with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement input validation and parameterized queries (prepared statements) to prevent SQL injection. Additionally, enforce authentication and authorization checks on sensitive operations such as deletion of products.