The vulnerability CVE-2026-76785 affects amirsanni Mini-Inventory-and-Sales-Management-System version 0.1. It is an SQL injection flaw in the Transaction::getAll function of the file application/models/Transaction.php. By manipulating the orderBy or orderFormat parameters, an attacker can inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) indicating network attack vector, low complexity, no privileges required, and no user interaction. The project has been notified but has not issued a patch or mitigation. Public exploit code is available.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation within the affected system. The vulnerability does not require user interaction or special privileges, increasing the attack surface. However, the impact is rated medium severity, indicating limited or partial impact on confidentiality, integrity, or availability.

No official fix or patch is currently available from the vendor. Since the project has not responded to the issue report, users should consider applying manual code review and input validation on the orderBy and orderFormat parameters to mitigate injection risks. Monitoring for exploit attempts and restricting access to the vulnerable function may reduce exposure. Check the vendor advisory regularly for updates or official patches.